Audit publication: verify repository-dispatch workflow identity correctly

[jeffhuber]

Problem

The verified local-audit workflow introduced by #1023 can run and seal an exact-head Claude PASS, but its default-branch publisher rejects the valid repository-dispatch run. GitHub reports the repository-dispatch event type in display_title (for example code-mower-local-audit) and the workflow identity in name plus path. audit_publication.verify_run incorrectly requires display_title == WORKFLOW_NAME, so publication always fails before creating a reservation.

The fresh dedicated runner also exposed two setup gaps: the source checkout needs the package's declared Python runtime dependencies through a stable CODE_MOWER_PYTHON, and the optional metadata-upload step invokes code_mower.cli without restoring the support checkout's src path.

Scope

• Validate immutable publication identity using the API's workflow name, trusted workflow path, event, repository, default branch, run attempt and SHA. Do not weaken any existing source seal, exact-head, receipt, replay, identity or digest checks.
• Add realistic regression fixtures where repository-dispatch display_title is the event type and name is the workflow name; reject wrong workflow names and paths.
• Make the metadata-upload step import the default-branch support package explicitly.
• Update the local audit runner guide with a stable Python 3.12+ environment containing Code Mower's declared runtime dependencies, configured through CODE_MOWER_PYTHON, and a runner-job preflight. Keep credentials and provider output private.
• Regenerate owned workflow/package artifacts as required and validate with focused tests plus relevant CI.

Delivery

Use one Code Mower Codex writer and an independent Claude exact-head review. Produce a focused PR, resolve all P0/P1/P2 findings, pass CI and the authoritative gate, then merge. No provider rerun, Slack/provider canary, release, deployment or credential change is part of this issue.

[jeffhuber]

Implemented #1025 in draft PR #1026: #1026

Head: a4c46336658cc324aae6c0a7530d60fc32585e73 (sole source writer: Codex).

The publisher now verifies the API workflow name while preserving the trusted path and all existing publication provenance checks. Added realistic dispatch-title and wrong-name/path regressions, restored the metadata step's support import path, and documented a stable Python environment with a private runner-job preflight. Owned helper/template/workflow artifacts are synchronized; the package manifest was regenerated and is unchanged.

Local validation passed: 25 publication tests, 100 audit-wrapper tests, 6 labeler tests, 4 generated-actionlint tests, actionlint for all 15 generated workflows and the checked-in audit workflow, Ruff, privacy scan, template guard, compilation, and 22 release-readiness checks. The documented preflight passed with the configured interpreter and refused missing/invalid/shadowing selections. The broader build-loop suite had 6 failures and 2 errors in lane-supervision fixtures; full CI is running at https://github.com/codemower-ai/code-mower/actions/runs/35307934471 .

Independent Claude exact-head review was requested using needs-claude-audit. CI, audit publication, and the authoritative gate remain pending. The publisher runs default-branch code, so the existing bug may also prevent this PR's audit from publishing; no gate bypass, provider rerun, canary, credential change, release, deployment, or cloud upload has been performed.

[jeffhuber]

Mac lane runner (codex): this run ended without a validated delivery. The unit stays open for the next cycle.

• provider exit: 130
• supervision: interrupted
• observed transition: none
• classification: supervision_ended_without_delivery