fix(ci): prove publisher lineage with the central Dagger function (draft: pinned at ci#50 head)

[hseshadr]

TL;DR

Draft on purpose. Pinned to hseshadr/ci#50 head 3de1c4b. That commit is not on ci main until #50 merges. Re-pin to the ci merge SHA after ci merges, then mark ready.

publish.yml now starts with portfolio-foundation's release-lineage, exactly the step ci#50's fleet policy accepts. Modeled on edgeproc-core#60. The job if (head_branch == default_branch) also passes for a workflow_dispatch on a tag named main. Until now edge-proc's publisher had no lineage check at all, so that tag's release-candidate.yml could produce bytes the publisher would upload over OIDC. The lineage call proves from GitHub's run records that the candidate is a successful release-candidate.yml dispatch here for exactly HEAD_SHA, and that main contains it, before any artifact is downloaded. Event values reach the action's bash only as quoted env vars.

Claim touched: "a publisher only publishes bytes whose candidate run came from main".

Contract changes (called out on purpose)

• test_should_keep_oidc_publisher_source_free_and_shell_free pinned the step list [download, pypi-publish]. It now pins [dagger (lineage), download, pypi-publish], still with no run: step.
• docs/OPERATIONS.md said the OIDC job "only invokes pinned artifact download and official PyPI publish". It now names the lineage proof too, and test_release_runbook_keeps_build_code_outside_the_oidc_job pins the new wording.

Evidence

Check	Result
New tests before the workflow change	red: 4 failed (2 new lineage tests, the step-list test, the docs contract)
After the change	green: 81 passed (test_workflow_security.py, test_release_contract_docs.py, test_sdist_contract.py)
Mutation: drop --publish-run-id	red: 1 failed; ci#50 policy reports publisher-lineage
Mutation: paste ${{ github.event.workflow_run.head_sha }} into lineage args	red: 3 failed; ci#50 policy reports dagger-args-expression
Mutation: delete the lineage step	red: 3 failed
uv run poe gate (lint, format, mypy strict, xenon A, pytest)	green: 750 passed, 98.63% coverage
ci#50 validate_workflow on all workflows	publish.yml 0 findings. The 3 remaining (shell-step ×2, candidate-order) are in release-candidate.yml, same as main, and #76 fixes them
git merge-tree vs main, #75, #76	clean

Merge order

1. feat(fleet): enforce per-module required-minimum pin floors ci#47 → docs: lead with the real EdgeProc loop #48 → test: close release guard mutation gaps #50.
2. Re-pin this PR's module: SHA to ci#50's merge SHA and mark ready. Merge with ci: pin Foundation to the rerun created_at skew fix #75/fix(ci): shell-free release candidate that keeps the tag out of script text #76 in any order.
3. Merge this before hseshadr/ci feat/require-publish-lineage (which makes the lineage step required).

Not verified

• A real publish. That needs a release dispatch, which this PR does not do.

🤖 Generated with Claude Code

https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a