Enforce fail-closed release workflows with regression tests

Treat publishing and CI transitions as security-sensitive state changes. Run only trusted default-branch code, pin actions and images immutably, isolate manual recovery through an unprivileged protected relay, and validate all external inputs before obtaining credentials. Bind approval and CI-ready transitions to the exact live request, revision, actor, label event, and request digest; revalidate immediately before every consequential transition and publication. Never advance changed, stale, malformed, or unverifiable requests. Ensure cleanup still removes approval state after early failures or malformed inputs. Add focused tests for workflow ordering, label transitions, input validation, byte preservation, state-file naming and collision resistance, cleanup paths, and other failure boundaries, then run the full test and lint suites.