ci: bind resources promotion to a verified revision

[Jeremy1844]

DO NOT MERGE — hosted promotion checks, protected non-production exact-SHA merge, environment protection, and rollback rehearsal are unverified.

Root cause

The scheduled stage-to-production workflow delegated status evaluation to a helper that could accept an empty or incomplete signal set, did not paginate Checks, ignored commit-status contexts, and identified the current workflow by names. It then validated the event SHA but asked the merge action to merge the moving stage branch, so a later revision could be promoted without having been evaluated.

This draft addresses only ADV-2026-0070 / RC-0070 (P1, confirmed code defect). It does not claim that an incorrect production promotion occurred.

Change

• Replace the external status helper with a repository-owned evaluator for paginated Checks and commit-status contexts.
• Fail closed on empty, pending, failed, malformed, cyclic/excessive pagination, redirect, or API-error states.
• Exclude the current workflow by immutable run ID and reduce reruns/status updates to their latest identities.
• Check out, evaluate, and merge the same ${{ github.sha }}.
• Keep the privileged token out of checkout and verification; its symbolic reference remains only on the final merge step.

The general action/permission hardening tracked by ADV33 and replacement of the privileged merge runtime/identity tracked by ADV71 remain separate. This draft intentionally does not bundle either root.

Exact publication unit

• Base: stage@9d237dd4fb37dd1fb936e3f9649020cc43a374c8
• Regression: 8c323e81961a99a70c97116553e5b465543e2231
• Head: 7cb36402ae317b0172d4dbf804a7cbc170159093
• Head tree: 746e98bd21cef2d7438d923748842fd3883ae7d5
• Scope: three files, 477 insertions, 9 deletions

Both commits use Jeremy Warren <309008057+Jeremy1844@users.noreply.github.com>.

Verification

• Regression: 0/8 expected failures.
• Head: 8/8 focused tests and evaluator syntax pass on Node 24.18.0.
• Open drafts fix: make resource validation read-only and fail closed #76–ci: validate resource dispatch identifiers #81 plus this head: 26/26 in both materialized merge orders.
• Both orders converge exactly at tree 97f988470c68c6972a687faab4af30563959023a.
• All eight workflows parse with js-yaml@4.1.0; the affected workflow has zero Actionlint 1.7.12 diagnostics.
• The full composed workflow set has only six inherited setup-node@v3 runner diagnostics outside this root; filtering that separately tracked diagnostic leaves zero findings.
• Existing decoded-Bash policy and rejection/credential-skip tests pass 3/3.
• Diff, two-commit topology, exact three-path scope, token-ordering, added-secret, and public-safety checks pass.
• src, assets, package.json, yarn.lock, and the encrypted deployment-credential object are byte-identical to the base.

The fork has Actions disabled and zero workflow runs, so this draft has no hosted execution evidence. GitHub's CLEAN label describes merge topology only; it is not validation of the promotion path.

Required maintainer gates

1. Exercise empty, pending, failure, success, pagination, malformed response, redirect/cycle, and stage-advance cases in a non-production repository.
2. Prove a protected non-production merge uses the exact verified SHA and fails safely on conflict or authorization denial.
3. Verify production environment reviewers, branch restrictions, and token ownership privately.
4. Review historical event SHAs and production merge parents privately.
5. Retain a verified production manifest and rehearse exact-SHA rollback.
6. Land ADV71 separately before relying on the privileged promotion runtime.

No user-data, schema, content, package, generated-artifact, or client migration is required. If the new gate blocks unexpectedly, disable scheduled promotion; do not restore empty-set success or merge a moving branch after validating another SHA.