Bind publication assessment to the checkout selected by the workflow

[devantler]

🤖 Generated by the Agentic Engineer

Problem

Publication assessment checks out current main but selects the dispatch-time commit. If main advances while the job waits, a valid current checkout and matching successful CI are refused before assessment.

Reproduced against reviewed 739d01b using the actual command and isolated offline fixtures. This is one defect family; related input variants belong to this issue.

Proposed direction

Resolve the assessment commit from the actual checkout and preserve the independent remote-tip and successful-CI bindings.

Acceptance criteria

A queued dispatch whose checkout advances assesses that checkout. Stale checkout, wrong CI and mismatched remote tip still refuse. Publication remains explicitly opt-in.

Size: Small.

Part of #101.

[devantler]

🤖 Generated by the Agentic Engineer

Delivered by #529 at signed merge 52e20bf. The current-head required checks and substantive review gates were complete before merge. Fresh protected-main fetch and immutable blob comparisons verified all eleven changed files match the reviewed implementation. Native command and workflow assessment controls exercised the active issue requirements. Production marketplace publication remains explicitly opt-in and is not claimed by these fixes.