Preserve trusted manual recovery and block stale approvals from reaching ci-ready

When modifying release or CI-poller workflows, always retain a workflow_dispatch path for manual recovery, preferably through a protected relay that causes the main poller to run trusted code from the repository default branch. Never execute secret-bearing workflow logic from an arbitrary dispatch ref. Bind processing to the current accepted-label event and revalidate the exact approval and issue identity after CI and immediately before adding ci-ready; if the issue was renamed, altered, re-approved, or the approval cannot be verified, remove approval/pending labels and stop promotion. On the valid happy path, ensure the poller freshly adds ci-ready so the label event reliably triggers publishing.