fix(ci): harden CI and source-only releases

[ddurst-nvidia]

Pull Request

Why

• The protected PR controller needs exact low-trust authorization bindings and
  uniform candidate isolation across the YamlSigil repositories.
• Official publication must give release-plz source-crate authority only while
  preserving Trusted Publishing and immutable source-only GitHub Releases.

What changed

• Add the shared protected controller, no-follow candidate checkout, sensitive
  adoption policy, DCO/signer checks, bounded API reads, and platform-aware CI.
• Make release-pr.yml a thin manually bounded entrypoint and move proposal
  implementation into a call-only reusable workflow.
• Keep the crates.io job read-only on GitHub and OIDC-authorized only for source
  publication; isolate release intent, finalization, and notification behind
  separately scoped App tokens.
• Disable tag and GitHub Release creation in release-plz, then verify exact
  ordered registry state before creating annotated tags and immutable
  zero-asset Releases with the protected finalizer.
• Add bounded process-tree, pipe, Cargo metadata, archive, no-follow file,
  partial-transaction recovery, internal dispatch-schema, historical Release,
  and settings-readback tests.
• Recheck a manual proposal owner's and merger's current write permission at
  final source authorization, retain opaque Cargo-generated Cargo.lock in
  complete archive equality, and terminate and reap after status-poll errors.
• Reconcile contribution and operator guidance with the new authority and
  recovery boundaries.

This branch starts at current main. It does not modify or supersede another
existing pull request, and it contains no unrelated non-CI changes.

Compatibility impact

None. Public Rust APIs, crate CLI behavior, release-plz version, Trusted
Publisher identities, App installation and permissions, operator release path,
and public external trigger contracts are unchanged.

Release and artifact impact

No release operation or repository setting was performed. No workflow was
enabled, and no tag, Release, package, asset, container, or retained executable
artifact was created. The workflow remains capable of crates.io source
publication followed by immutable source-only GitHub Releases.

Testing

• actionlint 1.7.12
• shuck check .github/scripts
• python3 -m unittest discover -s .github/scripts -p 'test_*.py'
  (124 passed, 1 platform-only skip)
• rumdl check . (22 files)
• cargo xtask ci and cargo +1.95.0 xtask ci
• xtask suite (132 passed, 7 explicitly spawned helpers ignored)
• exact Cargo 1.95 source-archive contract
• package-content, archive, process-tree, dependency, and source-only release
  regressions
• git diff --check
• git verify-commit HEAD

Checklist

• The commit is cryptographically signed and DCO-compliant.
• No security-scan-*.md file is changed.
• No executable artifact publication path is added.
• Documentation and boundary regressions cover the changed behavior.

[ddurst-nvidia]

/ok to test 5863351

[ddurst-nvidia]

/ok to test 4cf896c

[ddurst-nvidia]

/ok to test ed47e8f

[ddurst-nvidia]

/ok to test 69697c7

[ddurst-nvidia]

/ok to test 46fb1c9

[ddurst-nvidia]

Replacement-head evidence for security re-review: head 46fb1c9 is the signed, DCO-compliant, GitHub-Verified child of the previously reviewed 69697c7. The only change is the byte-identical protected-controller fork-signature repair already reviewed in spec #24. Protected run 33209088929 passed every job and finalized App-owned Required CI check 98977641635 successfully. Exact-head CI run 33209087549 passed every job, including Linux, macOS, Windows, workflow/controller, documentation/Protobuf, and aggregate Required CI. Both runs retained zero artifacts. GitHub reports this exact head mergeable and clean. The earlier merge approval is stale because the head changed; this comment requests review of the exact replacement head.

[ddurst-nvidia]

/ok to test d0fdc19

[ddurst-nvidia]

/ok to test d7bb155