fix: harden stable release recovery - #21

What changed

• require secrets: inherit on every local reusable publication caller
• fail before checkout or API use when the protected live credential is empty
• add a default-branch-only recovery workflow bound to an exact immutable tag and commit
• reject workflow reruns at both recovery and reusable publication boundaries
• enforce all controls with semantic checks and mutation tests
• document the recovery lifecycle and one-time remote variables

Root cause

The stable release caller invoked the reusable publication workflow without secrets: inherit. The called live-smoke environment was selected, but COMETAPI_KEY resolved to an empty string. Run 30348177128 therefore stopped before client construction; no live API request, OIDC publication, or PyPI upload occurred.

Impact

The repair makes missing secret propagation fail explicitly, prevents broad or replayable recovery authorization, and provides a reviewed path to publish the existing immutable v0.1.0 release without creating or changing a tag.

Verification

• uv run ruff check src tests scripts
• uv run ruff format --check src tests scripts
• uv run pyright
• uv run pytest -m "not live" (246 passed, 1 deselected)
• version, secret, workflow semantic, and actionlint checks
• wheel and sdist build, metadata, artifact, and clean-install checks
• standalone copied-checkout verification
• independent adversarial review with no remaining findings

No live API or registry mutation was performed while validating this PR.