fix: accept Actions token for guarded APT publication, prepare v1.0.3

[vriesd]

Problem

The v1.0.2 release built and published successfully, but publish-apt failed because repository permissions.push was false for the job installation token despite contents: write.

Fix

• Validate repository identity and probe the default-branch Git ref before interpreting a missing state ref.
• Require the existing non-forced state reservation write to succeed before deployment; write authorization is enforced by GitHub, not repository role metadata.
• Keep signature, monotonic version, package identity, first-publication, and fail-closed API checks unchanged.
• Prepare v1.0.3 without moving or altering the published v1.0.2 tag.

Verification

17 publication tests pass, including installation-token role flags, denied Git reads and denied writes. Signed APT repository smoke, workflow pin policy, Python lint and workspace check pass.

Release only after review, PR CI and exact merged-main package gates are green.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T11:07:07.119575Z	ecd0111	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.