fix(ci): prove publisher lineage with the central Dagger function (draft: pinned at ci#50 head)

[hseshadr]

TL;DR

Draft on purpose. This pins hseshadr/ci at the head of hseshadr/ci#50 (3de1c4b). That commit isn't on ci main until #50 merges. After it merges, re-pin to the merge SHA, then mark this ready.

publish.yml proved the candidate's lineage in a run: step (gh api + jq). The fleet policy forbids shell steps and reported shell-step and pypi-shape on it. Deleting the step to get green would reopen the tag-named-main bypass (#56). The proof now runs in the central portfolio-foundation release-lineage function, before the artifact is downloaded. It checks the same facts from GitHub's run records: a successful release-candidate.yml dispatch in this repo for exactly HEAD_SHA, and main contains HEAD_SHA. It also checks the publish run's own identity. The publisher is now Dagger → download → official PyPI, with no shell.

Claim touched: "only a candidate built from main is published to PyPI".

Tests

The shell-specific tests (jq clauses, set -euo pipefail) are replaced, not inverted. They described a shell step that no longer exists. The behavior they guarded is now tested in hseshadr/ci#50 (test_lineage.py: tag named main, tag not on main, mismatched SHA, wrong workflow/event/repo). Here the tests pin the exact central call, its env binding to the triggering run, and that no ${{ }} reaches a Dagger input.

Evidence

Check	Result
New tests before the workflow change	red: 3 failed
uv run poe gate	green: 359 passed, 99.31% coverage, ruff/mypy/xenon green
Mutation: --run-id=${{ github.event.workflow_run.id }} pasted into args	red: 3 failed
Mutation: lineage step deleted	red: 3 failed
Fleet policy from ci#50, run locally on this branch's publish.yml, dagger.yml, security-audit.yml	0 findings
Same policy on release-candidate.yml	0 findings with #59 applied (on main alone it still reports #59's shell-step/candidate-order, which #59 fixes)
git merge-tree vs #58 and #59	clean

Merge order

1. feat(fleet): enforce per-module required-minimum pin floors ci#47, chore(deps): bump the actions group with 3 updates #48, then Docs: add interactive architecture map #50.
2. Re-pin the module: SHA here to ci#50's merge SHA and mark ready.
3. Merge with fix(ci): shell-free release candidate that keeps the tag out of script text #59 in either order.

Not verified

A real publish. That needs a tag dispatch of release-candidate.yml, which this PR does not do. The function was driven live against real privacy-core runs (see ci#50), but its success path needs an in-progress publish run.

🤖 Generated with Claude Code

https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a