Use `ci-ready` as the sole publish trigger

Assume the CI poller always adds ci-ready, and gate the publish job on ci-ready label events rather than accepted. Keep approval and CI-waiting flows separate so publish cannot race waiting-for-ci. Bind transitions to the current request and approval event, revalidate before adding or consuming ci-ready, and ensure renamed, changed, or re-approved releases cannot publish using stale authorization. On terminal outcomes, reliably remove active authorization labels (accepted, ci-pending, and ci-ready), closing the issue only on success. Protect these lifecycle rules with focused fail-first regression tests and mutation checks.