fix: dispatch recovery from immutable tag

[tensornull]

Summary

• replace the unreachable deployment-event recovery with an exact workflow_dispatch request whose selected ref is immutable v0.1.1
• require the exact tag SHA, owner actor and triggering actor, reviewed main control merge, Release Please run, failed Publish run, artifact, annotation, and bounded live-smoke evidence
• preserve the existing npm tag policy, protected environment approval, OIDC-only publication, and three-request live budget
• record failed deployment 5667717157 as evidence and document the structured dispatch request

Evidence

• deployment 5667717157 created no workflow run because the immutable tag predates the temporary trigger; it is marked failed
• a read-only CI dispatch at ref=v0.1.1 produced run 30506623734 with head_branch=v0.1.1 and head_sha=c98b514227858cd183c781270a7f78f65b577e82
• no OIDC token or registry mutation occurred

Verification

• npm run verify (403 tests, tarball/package, publint, Are the Types Wrong, examples, ESM/CJS/OpenAI host fixtures, OpenAI minimum/locked/latest, standalone copy, actionlint)
• focused workflow tests: 193 passed
• git diff --check

After merge, the exact dispatch is still required. Its Verify and live-evidence jobs must succeed and the npm job must wait on the existing human environment approval before publication.

[tensornull]

Post-merge execution evidence: the exact publish.yml workflow-dispatch request with ref=v0.1.1 was rejected by GitHub with HTTP 422: Workflow does not have 'workflow_dispatch' trigger. GitHub resolved the workflow definition from immutable tag v0.1.1 (c98b514), whose publish workflow predates this trigger. No Publish run, environment approval, OIDC token, live request, or npm mutation occurred. RELEASE_PLEASE_ENABLED was restored to false; this path is a documented no-go under the unchanged v* npm environment policy.