Harden trusted release source checkout

[GGULBAE]

What changed

• checkout only GitHub's immutable event SHA in Trusted Release and reusable Compatibility jobs
• require publish confirmation plus protected master and exact event/input SHA equality before Compatibility starts
• verify event ref, event SHA, checked-out HEAD, supplied SHA, and freshly fetched origin/master before repository code runs in preflight and publish jobs
• disable dependency caching in privileged release jobs
• add fail-closed workflow supply-chain contracts and mutation tests for tainted refs, forwarded inputs, reordered/missing identity checks, and cache restoration
• document the resulting release trust boundary

Why

CodeQL identified seven high-severity cache-poisoning findings that all originated from one root cause: a workflow_dispatch input was used as the executable checkout ref before local actions, installs, builds, and package inspection. The previous post-checkout SHA validation was fail-closed at runtime but did not remove the untrusted-code execution boundary, and the parallel Compatibility gate could execute before that validation.

Impact

Trusted Release still accepts an exact reviewed source SHA, but the input is now an assertion only. Executable source always comes from the immutable workflow event commit on protected master. Accidental unconfirmed dispatches also avoid the eight-lane Compatibility cost.

Validation

• VITEST_MAX_WORKERS=2 pnpm verify — 59 files / 547 tests; coverage 94.10% statements, 86.13% branches, 98.40% functions, 94.58% lines
• pnpm example:typecheck
• workflow supply-chain and shell syntax tests — 16/16
• workflow YAML parse
• git diff --check
• independent adversarial review found no remaining P0/P1 issue