Always preserve trusted-code and approval-integrity invariants

When modifying or merging publish workflows, prioritize security invariants over textual upstream behavior. Run executable workflow code only from the trusted default branch, pin actions and publishing images immutably, and validate repository, version, and path before privileged API calls. Bind approval to the exact issue title, body, labels, and accepted-label event; revalidate after long-running CI and immediately before applying ci-ready or publishing. If the issue, revision, or approval changes, never regenerate approval automatically or advance in the same cycle—rewrite if needed, remove accepted and ci-pending, and require fresh approval. Preserve manual recovery through a trusted workflow_dispatch path and ensure malformed input cannot block security cleanup such as removing accepted.