Preserve secure CI-poller recovery and fresh ci-ready handoffs

When modifying release workflows, keep manual workflow_dispatch recovery through a minimal no-secret relay with permissions: {}. Never expose repository secrets to dispatcher-selected workflow YAML; use only a protected production environment restricted to main for privileged handoff. Preserve the CI poller’s behavior of always adding or re-adding ci-ready after CI succeeds, even if it existed previously, because the fresh label event prevents races with waiting-for-ci and triggers publication. Keep workflow conditions, comments, authorization checks, and tests consistent with this required event-emission behavior.