ci: register staging-only component metadata repair workflow

[adrianwebb]

Outcome

Register the already-verified staging workflow on GitHub's default branch so workflow_dispatch can run it against staging. This is a one-file workflow registration, NOT an application or Identity production promotion.

Work authority

• Issue: Canonicalize component runtime before computing its release digest #103; Reject noncanonical component manifests before host quiescence; repair release digest generation deployment#666
• Actor/human authority: adrianwebb
• Agent: Codex (agent-authored)
• Exact base: 2ccc25e
• Exact head: 46531ee
• Accepted source: staging 84f5796, PR fix: repair Admin packaging metadata without an Identity cutover #105
• Human review is required because this PR targets main. Do not auto-merge.

Plan and changes

Copy only .github/workflows/component-revision.yml, byte-for-byte from accepted staging. GitHub returned HTTP404 for dispatch while the workflow was absent from default branch main.

The workflow rejects every ref except current protected staging. It runs the staging metadata-repair tests and appends a new checksum-bound component metadata asset to an existing RC. It preserves source/image identity, does not overwrite assets, rebuild images, publish npm, or alter release tags. The referenced tooling remains on staging and is used only by an explicit staging dispatch.

Verification

• Staging PR fix: repair Admin packaging metadata without an Identity cutover #105 Verify: https://github.com/treeseed-ai/admin/actions/runs/34460994971 — passed.
• Local git diff --check — passed.
• Main publish.yml inspected: only release-tag pushes/manual dispatch, with a stable-tag job guard. Merging this workflow registration does not trigger production publication.
• Branch/main CI remains required; evidence appears in Actions.

Risk and rollback

No application code, credentials, runtime configuration, version, or production inventory changes. Revert this one-file registration if needed; no data migration is performed by merging this PR.

Completion

Unblocks staging-only repair of Admin rc35 metadata, needed before the shared PostgreSQL/Identity migration. The host has rolled back safely and health checks pass; the actual Identity plan remains incomplete.