Enforce release workflow security invariants fail-closed

Treat publish and CI workflow changes as security-sensitive. Preserve trust boundaries by using trusted checked-out code, immutable action/container pins, snapshot-bound attestations, strict ordering of approval revalidation, and fail-closed parsing and authorization. Add or update focused unit, integration, and workflow-text tests for malformed or adversarial inputs, stale/revoked approvals, unsafe repository/path/version values, unexpected actors, and partial API failures. Verify side effects precisely, including call counts, ordering, label changes, issue closure, comments, and absence of privileged API calls before validation. Prefer shared parsers/resolvers over shell regex extraction, and preserve exact data such as event IDs, SHAs, casing, CRLF bodies, and workspace paths.