ci: separate candidate validation from release authority

[jason931225]

Outcome

Separates candidate validation, protected release provenance, and post-merge evidence. Ordinary PRs no longer require the historical signed C/T authority train or authority-ledger tip commits. The stable authenticate-console-authority context remains protected/read-only and admits ordinary PRs from exact live GitHub coordinates plus ancestry, without executing candidate bytes.

Release-like PRs cannot fall through to the ordinary route. They retain exact path/content/graph classification and a native proof from the protected Release Please workflow. Required CI gains an exact release-metadata-only lane, semantic manifest/CHANGELOG checks, and skip-aware aggregates so policy/preflight failures do not masquerade as PostgreSQL or product failures.

Risk and governance

• Ordinary commit signatures are no longer an authorization primitive. Repository merge permissions and review governance are the authorization boundary; current branch protection has zero required approvals, and that accepted residual is documented rather than hidden.
• No candidate bytes execute in pull_request_target; no PR secrets, write token, package, image, production, or deployment change is introduced.
• RELEASE_PLEASE_TOKEN remains unprovisioned and is a post-merge operational HOLD. PR chore(main): release 0.3.7 #760 must remain auto-merge-disabled until its release tip is regenerated through the protected workflow.

Verification

• env PATH="/tmp/console-ci-boundary-dotslash/bin:$PATH" npm run verify — passed, ending verify(fast) passed
• focused protected/release suite — 40/40 passed
• independent test-contract suite — 47/47 passed; documentation custody 453/453
• git diff --cached --check — clean before commit
• independent CI/Actions and test-contract reviews: READY; security review: source READY, guarded transition required

One-time cutover

The current protected-base authority workflow still requires the retired signing key, so this PR cannot self-host its replacement. After exact-head Required / CI and Required / Security pass: disable and verify all auto-merge, snapshot protection, temporarily remove only authenticate-console-authority, squash-merge this exact head by SHA, and unconditionally restore all three strict app-pinned contexts with readback. Then exercise the restored context on temporary one- and two-commit canary heads. Any state drift or restoration failure is a repository-wide HOLD.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.