fix(release): require observed config publication

[AprilNEA]

Summary

• accept release-manifest v2 and strictly validate its Pages observer evidence
• require v2 evidence for production and all real build plans while retaining v1 only for the reviewed nonproduction fixture
• bind deployment source to sourceGitSha and require one deployment/source/key/verification identity across platform manifests
• preserve independent configurable publisher/source repository checkouts and existing scoped App tokens

Validation

• focused release workflow/render tests (32/32)
• pnpm check:ci
• pnpm test (337 files passed, 3 skipped; 2916 tests passed, 5 skipped)
• workflow YAML parse
• git diff --check

This PR does not publish a release or change GitHub Environment variables or secrets.

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 9pm (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f8ed5e714

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 9pm (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[linear-code]

CORE-125