publish reconciliation mutation anchoring

Trap: globally removing a repeated reconciliation command looks like a valid mutation because both .github/workflows/publish.yml blocks contain nearly identical label cleanup, but it may mutate the earlier best-effort block instead of the final authoritative block. Fix: anchor mutations to the named Verify publish issue reconciliation section and inspect the diff before testing so the regression proves the intended final-cleanup invariant.