[andregoepel]

Refs #29.

Core's registered publication workflows remain disabled, so their runner path has not yet been exercised. Add a separate manual, main-only no-upload rehearsal using the existing protected sonar-main environment and the pinned shared C# verifier. It runs the shared offline fault suite and actual recorder, rejects four invalid live invocations before package preparation, then verifies fresh main evidence and builds/checks local package and symbol archives.

The workflow has only contents/actions read permissions. It has no OIDC permission, NuGet login, package upload, tag creation or deployment. Existing Actions, standby guards, policies, environments and other repositories are unchanged. This does not complete hosted tagged provenance, stored-intent verification or legacy-publisher removal; #29 remains open. The hosted rehearsal requires a fresh main analysis and a manual dispatch after review/merge.

Validation:

• Merged main afaa5c9: CI 40087540674 and Sonar 40087584458, attempt 1, passed. Eight tests; 100% overall/new coverage across four new lines; no findings; accepted baseline unchanged.
• The new script passed against that live evidence in isolated Linux: missing credentials, prohibited dummy publication credential, wrong revision and wrong producer rejected before preparation; real .nupkg and .snupkg built and independently hash-checked; no upload.
• Exact runner test command: 1,086/1,086 shared offline tests passed. Recorder 11/11; Core 8/8; clean Release builds, dependency audits, Bash syntax, actionlint, CSharpier and diff checks.

Exact-head PR CI 40088412548, attempt 1 passed for b5be1a67b2fe260554b86bfa56f488f0877ee773; publishing was skipped. Core has no separate E2E workflow. No merge or hosted dispatch is performed by this PR preparation.