[EHotwagner]

Implements the root decision on #4753 (comment): one org-wide serialized publication writer, replacing the aggregate-resource profile, with the "genuine next Wizard release" prerequisite dropped. This is the .github half; producer repositories adopt the same step in their own PRs.

Mechanism (ADR-0097). GitHub concurrency groups are per repository, so no group can serialize publishers in different repositories. A producer's GITHUB_TOKEN cannot write elsewhere, the ledger App key lives in .github alone and the nuget.org Trusted Publishing policy pins each producer's own workflow, so a journal-CAS lock or a central workflow would need credentials or moves that do not exist. The lock therefore uses the public Actions job list: every publishing job has a step named Acquire org publication writer lock (composite action .github/actions/publication-writer-lock) and a display name containing [org-publication-writer] (the live Actions API often returns no step list, so participants are recognised by job-level name/status/started_at only); its ticket is the job started_at then job id; it proceeds only when no other in_progress participant in a registered repository has a smaller ticket (registry/publication-writers.json, read live from main). The oldest live job always proceeds, so there is no cycle. The job's end is the release, so a crashed holder cannot deadlock. A seven hour lease ignores ghosts, waiters fail closed after a bounded wait, and any unreadable registry, listing or own-job record never acquires. It grants no authority: candidate, journal CAS, revocation, protection and the live-main equality guard are unchanged.

Changes.

• Replace the three per-repository publisher groups with the lock step: both Wizard writer jobs (recovery-diagnostic stays outside), the coherent publisher and its install-only suspension job, and the Telemetry Host publisher. Reseal the Wizard route by an exact inversion layer in tests/release-effect-sealing; update the Wizard writer-scope tests.
• scripts/publication_writer_lock.py, the composite action, registry/publication-writers.json and scripts/check-publication-writer-coverage.py (--local is a required selftest, --remote reports adoption).
• ADR-0097, the publishing skill paragraph (both mirrors, driver-manifest/skills-registry digest and changelog reconciled), and one stale sentence in telemetry-host-release.md.

Controls (tests/publication-writer-lock/run.py, credential-free; a virtual clock drives real threads through the real acquire over a fake job list). Six publishers across six repositories enter strictly one at a time in ticket order; three mutants (never blocks, blind to other repositories, every holder a ghost) each produce overlap or refusal. A holder that dies without releasing is replaced within one poll. A 7h+ ghost is ignored, a live young holder blocks and the waiter fails closed. Persistent read failure never acquires; transient failures are retried. Unregistered repository, missing gate step, missing or ambiguous job refuse. Equal tickets order by job id; non-participant jobs do not block. Nine registry defects, nine unsafe workflow placements and a 12-publisher pile-up are covered. Existing suites: new-sdd-workspace-successor 228, release-effect-sealing (new layer, 5 repinned workflow and 6 document mutants), release-successor-execution/candidate/live/recovery, telemetry-host-successor pass locally.

Independent review (round 1, fsgg-critic-normal) and response. Fixed: step-list-based participation (now name marker), single-shot HTTP reads (4-attempt backoff), lock wait eating the job clock (writer timeouts raised by exactly the declared wait, check-workflow-timeouts.py ceiling = 60 + declared wait), checker gaps (marker, gate first after checkout, credential/tag/API writes, release-saga-start now exempt with an honest reason), ticket from step clock, wait overshoot, ADR facts. Accepted and documented: the retired .104 continuation census refuses while a second dispatch waits; producers adopt in their own PRs.

Not in this PR. No publication, recovery or credential operation is run. The live-main equality guard and "hold main stable" for candidate/source equality remain (Done when clause 1). Producer adoption follows in each repository's own PR; FS.GG.Coordination is exempt in the registry because its Actions allow-list admits only GitHub-owned actions and one NuGet/login digest. The qualifying journey is the next ordinary publication by its own owner: observe it with GH_TOKEN=$(gh auth token) python3 scripts/publication_writer_lock.py observe and the waited-seconds output of its lock step.

Refs #4753 #4730.
architecture-map: unaffected

🤖 Generated with Claude Code