[Pigbibi]

Summary

Pin the complete Health Refresh candidate to source 0b5d9527313d719547ef844797b47158c83dea53 and the current serving 85504dd6ee201fd358f6ea3489742ea5c47afcf8 bundle as the exact recovery target. Preserve the existing shared release lock, protected environment, main guards, byte and configuration checks, and migration protections.

Validation

• Node 22 and Wrangler 4.106.0 produced identical candidate bytes in two offline dry runs: SHA-256 59b2316fb8153a4266d60baed19ac781c4de503d4850a9898853da2a1949badb.
• The serving recovery bundle matches SHA-256 44386d5bb3eddf40be110c2503bfbeae5a3cc1b227eaef03a31846e8ea4098af.
• Synthetic SQLite upgrade and recovery passed for both historical-to-candidate-to-recovery and serving-predecessor-to-candidate-to-recovery, with native rows retained.
• Candidate and recovery named exports match; the candidate test helpers remain inaccessible through HTTP and RPC in workerd.
• Release adapter: 43 tests passed; frontend build and asset synchronization, actionlint, and git diff --check passed.

No deployment or production write was performed by this PR.