chore(security): regenerate the approved publish-workflow revisions

[botantler-1]

🤖 Generated by the Agentic Engineer

Why

The cluster only trusts releases signed by publishing-workflow revisions it
has approved. A consumer's deployed release or workflow pin, or the latest
publishing-workflow release candidate, has moved, so the approved list is
out of date.

What

Refresh the approved list and each consumer's matcher from what is deployed
and what each consumer currently pins. Every consumer resolved on both halves,
and each matcher accepts exactly its approved revisions.

No issue: trivial fix.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T22:21:17.904416Z	7cdaff1	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 7cdaff1f10

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at head 7cdaff1f10c49c094751b7a53eb76c107d14c131

• What changes: the newest approved release candidate of the publishing workflows moves from 673611e7 (actions 13.10.9) to 6f3d2b43 (actions 13.10.10) in the four consumer matchers and their rows, and the .github identity row moves to release 7.10.1. Each consumer's deployed and pinned revisions are unchanged.
• Checked at source: 6f3d2b43 is the signed release commit of actions v13.10.10 (published 2026-10-12 21:03 UTC), and neither publishing workflow file changed between the two candidates. The identity row's digest equals the github-config artifact production runs now (7.10.1), and the other three rows' digests equal the deployed artifacts.
• Behaviour evidence: CI run 38309949306 succeeded at this head; its job 🔍 Detect Changes printed 4 consumer matcher(s) agree with scripts/publish-workflow-approved-revisions.tsv (enforce=1).
• Review: CodeRabbit has no review seat on a bot-authored pull request; Codex reviewed 7cdaff1f10 and found no major issues. No review threads.
• Not exercised here: signature verification against a release signed by the new candidate. No consumer has published with it yet; the deploy in the merge queue verifies the currently deployed artifacts with the new matchers.

[devantler]

🤖 Generated by the Agentic Engineer

Read back in production after the merge (2026-10-12 23:34 UTC, merge commit 4cde4e09). All four sources carry the new matcher, have observed their current generation and are Ready, so each deployed artifact still verifies: ascoachingogvaner 1.13.10, aws 1.1.3, github-config 7.10.3 and wedding-app 1.15.19. The platform health check reads OK.

github-config has moved from 7.10.1 to 7.10.3 since this pull request was generated, so the next regeneration will update its identity row.

[devantler]

🤖 Generated by the Agentic Engineer

Read back after the merge (merged 2026-10-12 23:34 UTC through the merge queue, production deploy included): the four consumer sources (ascoachingogvaner, aws, github-config, wedding-app) each carry the new approved revision 6f3d2b43 in their signer rule, are Ready and signature-verified, and have observed their current generation. Platform live health reads OK. Nothing further is owed here.