fix(security): regenerate approvals after canonical publication #4736

🤖 Generated by the Agentic Engineer

Evidence and impact

The default-branch approval regeneration failed in run 38119255789. The configuration release has a successful publishing run, but the generator only recognizes the legacy publisher repository and reports zero signing revisions when the canonical publisher was used. The signing report already preserves the publisher identity; the approval generator still loses that distinction.

The daily job cannot refresh any consumer because it correctly refuses to write a partial set. Existing signature verification remains required.

Expected behavior

Recognize the actual publisher identity and accept a canonical publication only when its exact revision is already approved for that consumer. Keep the retained legacy compatibility approvals separate from current canonical observations, and never put a canonical revision into the legacy publisher subject.

Acceptance criteria

• Reproduce canonical publication and current-pin handling with offline positive and negative controls.
• Preserve exact tag/commit, successful publishing-run, repository/workflow identity, and complete-consumer checks.
• Record current observations with their publisher identity while retaining explicitly identified legacy compatibility evidence.
• Refuse unapproved, ambiguous, malformed, or unavailable observations without writing partial outputs or changing canonical approvals.
• Validate the complete output before replacing files, keep unchanged generation idempotent, and verify the default-branch scheduled job after merge.

Size: M. This is the live-CI repair slice of #4713; approving a newer canonical publisher remains separate.