fix(ci): harden release evidence publication

[vincentkoc]

Summary

• ingest the attempt-qualified Full Release Validation manifest instead of scraping job logs
• bind evidence to the successful parent attempt, workflow SHA, target SHA, exact package spec, release ref, artifact digest, child runs, and reuse provenance
• publish with the same-repository github.token, clear stale run files, and verify the generated tree survives rebase and is byte-identical on origin/main
• record current npm and public GitHub release state

Validation

• node --test scripts/openclaw-release-evidence-contract.test.mjs (6 passed)
• node --check on all three evidence scripts
• actionlint -shellcheck= -pyflakes= on both evidence workflows
• yamllint on both evidence workflows
• git diff --check
• release-evidence environment API readback
  • reviewer team openclaw-release-managers (16590423)
  • self-review prevention enabled
  • custom branch policy: main / branch
  • zero environment secrets and zero environment variables
• read-only beta.7 dry run against Full Release Validation run 30714067986
  • artifact 8822791237, attempt 1
  • artifact digest verified
  • exact tag resolved to dabe1915362e20c25704af91612a32a8f4c96e83
  • 3 blocking and 2 advisory runs passed
  • npm and public prerelease state recorded
  • strict persisted-evidence verification passed
• ClawPatch exact-head agent-mapped review 20260806T090220-3b63a1: 4 release-evidence features, 0 findings

Scope

• frozen base: ef0c28e194e374035cded74b92f6abb399636ae7
• production scripts: net +111 lines
• focused test: 250 lines
• no workflow dispatch, evidence backfill/publication, npm/tag/release, Docker, ClawHub, or native release mutation

Pending

• GitHub reports can_admins_bypass: true for release-evidence; Settings UI verification must disable administrator bypass before merge
• the full temporary-git-remote publication harness remains a post-merge E2E follow-up under the reviewed scope ceiling