Fix repository-dispatch audit publication identity

[jeffhuber]

Summary

Repository-dispatch audit publications were rejected because GitHub uses the event type as display_title. Validate the workflow's API name alongside the existing trusted path and provenance checks, so valid sealed verdicts can publish while wrong or missing workflow identities still fail closed.

Restore the default-branch support package's src import path in the optional metadata-upload step and its maintained/package templates. Document a stable Python 3.12+ environment with the package's declared dependencies, CODE_MOWER_PYTHON, and a private runner-job preflight that checks interpreter selection, dependency versions, and source imports without invoking a provider.

Closes #1025.

Sole source writer: Code Mower Codex (builder:codex). Independent Claude exact-head review requested with needs-claude-audit.

Validation

• Publication regressions: 25 tests passed, including actual labeler and generated gate consumers, exact-head/source-seal/receipt/replay checks, realistic dispatch titles, rejection of wrong workflow names and paths, and a shell execution test for support-package metadata imports.
• Audit-wrapper regressions: 100 passed. Labeler regressions: 6 passed. Generated-workflow actionlint tests: 4 passed; actionlint also passed for all 15 generated workflows and the checked-in local-audit workflow.
• Documented runner preflight exercised: configured environment passed; missing, invalid, and shadowing interpreter selections failed as intended.
• Ruff, privacy scan, workflow-template guard, compilation, and all 22 release-readiness checks passed. Regenerated the owned helper/template/workflow artifacts and verified the package manifest remains current.
• Local broader build-loop suite: 39 tests ran with 6 failures and 2 errors in lane-supervision fixtures (ContextError / fake provider did not run); full GitHub CI will provide the authoritative complete-suite result.

Risk / Rollback

Source seals, repository/default-branch/run-attempt/SHA checks, exact-head checks, receipts, identity floors, digests, and replay defenses remain in place. Reverting this PR restores the publication failure.

The default-branch publisher is itself the component being repaired. This PR's review must still use the trusted audit workflow and authoritative gate; an inability to publish that audit will be recorded rather than bypassed.

Data Or Secret Exposure

• This change does not add source, raw diffs, raw transcripts, raw provider output, tokens, or machine-specific paths to public artifacts.

No provider rerun, Slack/provider canary, release, deployment, credential change, or cloud upload is part of this change. Test upload commands use a synthetic local package and make no network requests.

[jeffhuber]

Bootstrap audit evidence

Exact head: a4c46336658cc324aae6c0a7530d60fc32585e73

The trusted self-hosted Claude audit completed with PASS and zero P0/P1/P2/P3 findings. Source run: https://github.com/codemower-ai/code-mower/actions/runs/35307942182. The reviewer-seal step completed successfully with digest 274fc04f9fef80ff97defde90c5a4c8e7e7f38ee3934ea77f5261f6bb8b5a0c4.

The audit comment could not publish because this PR repairs the default-branch publisher's repository-dispatch identity check. The failed publication is the expected bootstrap condition covered by #1025: GitHub exposes the event type in display_title, while immutable workflow identity is in name plus path.

This evidence is recorded for a one-time owner gate decision on this bootstrap PR only. After merge, #1024 must demonstrate the fixed end-to-end publisher and authoritative gate without an override.