Prioritize fail-closed, test-backed publishing security

When reviewing or changing the publishing system, preserve and verify security invariants end to end. Bind approvals and CI-ready state to the exact live issue title, body, relevant labels, actors, and latest label-event IDs; reject stale, malformed, manually forged, self-approved, or changed requests. Revalidate immediately before publishing. Keep automated approval allowlisted and proof-backed, isolate manual dispatches from repository secrets, use protected environments, and pin actions and containers to immutable revisions. Preserve workflow ordering that records attestations before labels and removes/re-adds ci-ready to generate a fresh event. Add or inspect focused tests that assert exact failure behavior, API calls, outputs, token separation, and step ordering.