fix(release): recover immutable VSTD 1.2.0 publication

[TimeLordRaps]

Purpose

Recover the Verifier Standard (VSTD) 1.2.0 publication path after the tag-triggered workflow stopped before artifact creation. The default GitHub Actions token cannot read the repository Administration endpoint for immutable releases; the failed exact-tag run returned HTTP 403 before creating a GitHub release or publishing to the Python Package Index (PyPI).

Exact recovery

• Preserve the existing signed v1.2.0 tag object and its target unchanged.
• Preserve .github/workflows/release.yml and the pypi environment identity used for trusted publishing.
• Dispatch the publisher from the protected default branch against an exact existing tag.
• Require the dispatcher to be the repository owner.
• Require an owner-authenticated immutable-release administration preflight immediately before dispatch.
• Recheck tagged protected-history ancestry, package version, protected conformance status, finalized metadata, tests, deterministic artifacts, signatures, and manifests.
• Require the published release's ordinary public metadata to report immutable: true.

The preflight is explicitly owner-observed. It is not mislabeled as an independent Actions-token observation.

Failure evidence

• Failed release run: 33525454862
• Failure: HTTP 403 Resource not accessible by integration while reading repos/TimeLordRaps/verifier/immutable-releases
• No GitHub release exists for v1.2.0.
• PyPI returned 404 for verifier-standard==1.2.0 before this recovery.

Commit coordinate

• Commit: 23fd58bc5b78d4bd30c9a05121f74bd8bc55383d
• Tree: a47f2414a59f4bf1c31b76ee918bf8b16c69fa75
• Parent: dcc9e95b1be9836375d5c52b13929d2c2ee6bf24
• Signature: unattended OpenPGP automation key; GitHub Verified

Changed surfaces

• .github/workflows/release.yml
• RELEASING.md
• AGENTS.md
• HUMANS.md
• TIME.md
• CHANGELOG.md
• tests/test_release_artifacts.py

No VSTD receipt semantics, schemas, wire identifiers, package code, tagged source bytes, or release artifacts change.

Validation

• python -m pytest -q tests/test_release_artifacts.py — 26 passed
• PYTHONPATH=src python -m pytest -q — 553 passed, 38 skipped
• python scripts/check_release_metadata.py --version 1.2.0 — final metadata accepted
• python scripts/check_time_status.py — CLEAR
• python scripts/check_presentation.py — passed
• python scripts/build_reference.py --check — passed
• python -m compileall -q src scripts — passed
• git diff --check — passed

Release boundary

This pull request authorizes no tag movement. Publication occurs only after this recovery passes protected checks and is merged, followed by a fresh owner-authenticated immutable-release preflight and explicit workflow dispatch.