[Release] Close the release-resume and tag-ancestry gaps

[DongyuZhao]

Three gaps found by review on the ported tex-core copy (nouprax/tex-core#12), all present here:

1. Tag off main could publish: validate only checked the tag name against VERSION; the checked-in tag policies match names, not ancestry. Both validate rows (push and resume) now run git merge-base --is-ancestor HEAD origin/main. The audit's historical-checks ban is narrowed accordingly (the ancestry guard is tag-local validation, not a check query) and now pins the guard's presence.
2. Resume skipped the Central commit: a failure between npm publish and maven-publish left the deployment VALIDATED forever — the tag run can't be rerun once the immutable npm version exists, and the resume path never called central-portal.sh publish. Resume Release now takes central-deployment-id as a required input and commits it to PUBLISHED (idempotently short-circuiting when already published) before the GitHub Release is created.
3. SOURCE_RUN_ID was trusted verbatim: the resume job now validates the source run before downloading anything — same workflow file, push event, head_branch equal to the release tag, head_sha equal to the tag commit — and asserts the downloaded npm tarball's version matches VERSION.

audit:ci green.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c717fa940d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

PR performance and binary-size diff

Benchmark execution is required; hosted-runner timing, memory, and size deltas are informational only.

Baseline: exact PR base b6b2c004009e (successful main CI).

Performance

Runtime	Workload	Median	Perf diff	Memory	Memory diff
c	representative_large	4.567 ms	✅ -25.1%	8,692 KiB	✅ +1.5%
es	deep_nesting	0.255 ms	✅ -34.7%	140,892 KiB	✅ +2.2%
es	large_document	33.661 ms	⚠️ +9.3%	140,892 KiB	✅ +2.2%
kotlin	deep_nesting	0.185 ms	✅ -7.6%	109,208 KiB	⚠️ +10.1%
kotlin	large_document	21.367 ms	✅ -7.5%	104,556 KiB	⚠️ +14.7%
swift	deep_nesting	0.120 ms	⚠️ +63.4%	26,112 KiB	✅ -0.5%
swift	large_document	13.414 ms	✅ -19.8%	25,936 KiB	✅ -0.7%

Binary size

Artifact	Bytes	KiB	Size diff
c-shared-library	501,888	490.1	✅ 0 B (0.0%)
es-wasm	288,573	281.8	✅ 0 B (0.0%)
kotlin-jvm-jar	312,972	305.6	✅ 0 B (0.0%)

Head CI run

Size deltas are deterministic for identical build inputs. Performance deltas compare separate hosted runners and should be treated as directional evidence, not a pass/fail threshold.