Verify publish issue reconciliation

Trap: one best-effort reconciliation before terminal reporting looks sufficient because it removes authorization labels promptly, but continue-on-error can silently leave stale approval state and later optional scripts may fail. Fix: keep a dependency-free if: always() reconciliation after all optional reporting, without continue-on-error; it authoritatively removes accepted, ci-pending, and ci-ready, and closes the issue only when Craft succeeded.