[diegosouzapw]

Main lacks the recovery controls for immutable OpenAPI comparisons, complete independent-package audits, declared static requirements, interrupted-process classification and exact hosted-suite provenance. Scheduled guards also used the pre-transfer repository owner.

Backport those controls, pin workflow dependencies, remove release cache reuse, keep supported patched Node versions and clean npm installs, and align guards with cheaper-inference/OmniRoute. Include the registration-order gate and #18046 fixes with contributor credit. Reconcile main-specific aliases and remove one proven stale allowlist entry.

The UI inventory uses four required shards with at most two workers and a receipt for every shard. Prepare real dependencies before timed assertions, enable React act checks and require fresh complete lint measurements. Required secret scans reject absent tools/source/baseline, invalid reports and scanner failures. Catalog prefix lookup avoids repeated full alias scans; limiter and streaming fixtures preserve the real runtime behavior with controlled timing. Translation reuse requires literal validation, source provenance and matching target hashes.

Unit coverage now collects V8 data during the original test invocation, compresses the raw bytes losslessly and generates the report once. The CI and Release-Green matrices require twelve unit shards under the existing deadlines. Final coverage validates all shard identities/hashes and preserves c8's global filename order; it rejects missing, mixed, duplicate or damaged inputs and still enforces the existing coverage thresholds.

Current head: 841633ad714e89ba88a12480a5afe99981a94a42; main base: edab7c3a59bf7d6f040d581dbda3a46adbee0d57.

Validation is scoped; these overlapping batteries are not an additive test total:

• Latest coverage/matrix backport: 47 tests PASS, explicit lint PASS, docs-all PASS, strict workflow scan with zero actionlint/zizmor/provenance/schedule findings.
• The coverage helper matches the real c8 CLI with V8/tsx source maps, rejects incomplete or altered data and preserves a failing coverage threshold. The same helper was compared against a captured release dataset: all Istanbul fields for 3,724 files matched. That dataset is diagnostic and does not certify main coverage.
• Earlier parity head 6ec5f52: 140 affected tests, core TypeScript and explicit lint PASS. Earlier secret-scan follow-up: 48 tests and the required real scanner PASS.
• Earlier combined main candidate c71cbc0: complete UI inventory 497/497 files, 3,406 PASS and one opt-in SKIP after a full fourth-shard retest; MCP 590 PASS. The initial 14 failures remain recorded. This does not certify the newer candidate.
• Prior backport/receipt/measurement and UI fixture checks remain archived with their exact heads. Dependency sources come from isolated installations; there is no new clean-install receipt for every subsequent head.

Actual mirror recovery is prepared separately in #18210. The combined main candidate also includes the separate dependency-security recovery #18174; this PR alone is not that combined candidate. Full main unit/UI/integration/coverage/build/package/boot and hosted acceptance remain pending. Draft recovery for #17267; no main merge, ruleset activation or deployment is certified by these focused results.