Preserve manual recovery while enforcing trusted release transitions

Always keep workflow_dispatch available for operator recovery, but never let a caller-selected ref control privileged execution. Ensure secret-bearing or write-capable jobs run trusted default-branch code, using a no-secret relay and protected environment where necessary. Bind release authorization to the exact live request, trusted actor, request digest, and current accepted label-event provenance. Revalidate this state repeatedly—before CI inspection, after CI succeeds, immediately before adding ci-ready, and before publication. Fail closed and remove approval when the issue is renamed, modified, closed, re-approved, revoked, self-approved, stale, malformed, mismatched, or unverifiable. A changed release must never reach ci-ready.