Summary

• keep current trusted publication/reconciliation scripts at the workflow root
• check out immutable release content separately for tag validation and release notes
• add a regression contract for historical release publication repairs
• update the consistency checker to require the immutable release-notes path

Evidence

• release run 30064838306 passed verification and every signed platform build, then publication failed before mutation because the old tagged reconciliation dependency graph loaded js-yaml without dependencies installed
• focused release consistency and reconciliation tests: 33 passed
• mise exec node@24.13.1 -- pnpm check
• mise exec node@24.13.1 -- pnpm lint