fix: repair Admin packaging metadata without an Identity cutover

[adrianwebb]

Outcome

Repair canonical component release integrity under treeseed-ai/deployment#666.

Work authority

• Work item / Issue: Canonicalize component runtime before computing its release digest #103
• Proposal / decision: Approved Identity/shared PostgreSQL plan; pre-cutover integrity recovery.
• Assignment / checkpoint: Canonical runtime producer and preflight correction.
• Actor: adrianwebb
• Human authority: adrianwebb
• Agent / capacity provider: Codex local development session
• Exact base ref: a61bb9e
• Exact head ref: 31df5fa

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Reject malformed metadata before writers stop; publish corrected immutable owner artifacts through normal staging gates. Never edit prior release assets or relax integrity.

Changes and commits

Add a checksum-bound, next-revision-only publisher for malformed Admin component metadata. Preserve original application version, source commit, images, Compose files and runtime behavior; change only packaging version/revision and canonical runtime digest. Publish an additional component-release-r2.json on the existing RC release without clobbering any asset. Protected current staging workflow uses no npm/image publication. Ignore only these packaging-tool-only paths in the image candidate workflow.

Verification

All 183 tests across 36 files pass, including repair, producer and bounded publication assertions; file-shape checks pass. Identical existing assets compare/noop; differing existing assets fail without overwrite. Actual installed rc35 artifact SHA256 matches the Platform lock and produces a valid rc35 revision 2 with unchanged images/source. Required Actions pending this PR. No live database transfer accepted; automatic rollback restored generation 19. API development targets restored and AI awake.

Risk and rollback

Bounded release metadata/preflight change. Previous component artifacts remain immutable. Replace selection only via exact Platform composition after Actions. Revert before publication if needed; retain known-good host configuration. No purge/bootstrap reinstall or training workload.

Completion summary

Implementation and local verification complete; Actions, staging merge, replacement metadata release and managed acceptance remain. Issue stays open through acceptance.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.