fix(release): recover exact legacy promotions

[monkseekee-max]

Outcome

Allows one additional reviewed promotion only for an exact unpublished legacy v1 receipt. It preserves the normal v2 rule: after a v2 promotion merges, recover the exact publisher run instead of creating another release PR.

Safety boundaries

• requires exactly one prior merged promotion PR
• rejects any abandoned promotion PR
• requires the legacy receipt source SHA, workflow run, exact-17 count, and asset digest to match the newly verified candidate
• final-tag absence remains mandatory
• keeps the deterministic release branch expected by the target publisher

Validation

• actionlint on all organization workflows
• governance workflow-policy fixtures: 41/41
• governance commitlint tests: 8/8
• git diff --check

This closes the pre-v2 v1.7.8 recovery gap without deleting provenance or moving a final tag.

[monkseekee-max]

@xionghaoh v1.7.8 is waiting on this fail-closed legacy receipt recovery. All organization checks are green; please review when available.