Always enforce trusted, state-bound release workflow transitions

Treat publishing and CI workflow boundaries as security gates. Before applying accepted, moving an issue to ci-ready, or publishing, validate the live canonical issue, current label events, actor provenance, and matching attestations; reject renamed, closed, changed, re-approved, self-approved, or unverifiable requests. Assume the CI poller is solely responsible for adding ci-ready. Keep workflow_dispatch available for recovery, but never execute arbitrary dispatched-ref code or expose repository secrets to it; check out a trusted ref and use protected environments. Use least-privilege permissions, avoid exposing RBAC data, and pin actions and publishing images to immutable revisions or digests. Add regression tests for ordering and final revalidation immediately before credential-bearing publication.