[shigurenimo]

Problem and resulting publication path

The workstation's final browser suite collided with another application's active development ports. Production publication must not require stopping that application.

Make the protected release push workflow the authoritative full verification environment. A new final CI step proves that all three browser suites ran, the checkout and verification receipt match the exact workflow commit, the tree is clean, and secret scanning covers that SHA.

The publication command accepts only a successful push run of the expected workflow on release for the current remote SHA, with successful full-verification, secret-scan and clean-commit evidence steps. It also requires branch protection and a clean, unchanged local HEAD, scans local secrets, and then publishes through the existing local Cloudflare authentication. Main/PR runs, partial evidence, skipped steps, stale SHAs and dirty checkouts cannot authorize publication.

Full E2E remains mandatory in CI. The workstation no longer repeats the browser suites during publication. No application behavior, credentials or development-server ownership changes.

Validation

• Formatting, documentation checks and three evidence-policy tests passed.
• Changed-HEAD subprocess probe passed before any remote access.
• Redacted history, tree and commit-message secret scans passed.
• Required full CI and the final exact-commit evidence check run on this PR and the merged release commit.