Treat regression tests as exact security specifications

When modifying the publish and CI workflows, use the provided tests as the authoritative contract. Preserve exact step ordering, environment variables, output text, API calls, immutable action/image pins, state-file naming, and byte-sensitive body transformations. Maintain fail-closed validation for malformed or stale requests, changed issue snapshots, approval events, attestations, actors, labels, paths, versions, revisions, and dispatch inputs. Do not weaken trust boundaries or bypass request-digest and live-state revalidation. Add or update focused unit and workflow-integration tests for normal behavior, edge cases, race conditions, and failure paths, and verify that rejected inputs cause no privileged side effects.