[EHotwagner]

Current publication preflight refuses valid required jobs from the maintained reusable workflows: the runner records actions/checkout@v7 after resolving it to the accepted action SHA, while the reader recognizes only a full-SHA step label. Authenticate each current checkout ref against its unique early runner download resolution, then select exactly one declared/synced Game repository and the checkout action’s own commit. Preserve wrong-pin/ref, late-resolution, foreign-repository, duplicate and ambiguous refusals, including the separate shared-repository checkout.

The connected sweep covers all 19 authentic required-job shapes and the installed/both-feed readers. The owning plan and Atlas retain the original read-only refusal and actual successful PR713/protected qualification. Historical successful custody remains intact; a new publisher requires new protected producer=executor qualification and originals. Publication is separately admitted.

Validation:

• Independent exact-source review; 35 focused inert publisher controls and the complete static/inert workflow preflight passed.
• Recorded native evidence replay passed for 16 full-SHA jobs, two resolved-v7 Game/shared jobs and one metadata-only job. This is historical data replay, not fresh publication admission.
• Seven model/generator inputs and all 71 independently accepted outputs remain byte-identical. No new generation or local CLR/Fable/model/browser workload ran.
• Normal 19 required checks and complete 35-minute WASM qualification remain required. The unchanged prior protected job completed in 829 seconds; current cold variation is unknown. The same setup, all suites, evidence collection and cleanup remain within that existing job limit.

Canonical lineage: WASM-SHARED-01, existing .5-P2→S1 under the shared WASM foundation plan. Same programme and dependency chain as merged PR713; no new roadmap outcome, publication or consumer pin.