fix(ci): load preview publisher without Git checkout

[rynfar]

The preview publisher added in #528 fails before its helper runs: checkout credential cleanup traverses vendored Git links that have no root submodule metadata, even in a sparse checkout (observed failure). This prevents both publication preparation and cleanup.

Both trusted jobs now load only the Node core-only publisher helper through the Contents API at the full github.workflow_sha. They verify its path, file type, encoding, byte length and Git blob digest before writing it to a private temporary file and executing it. Existing opt-in, current-head, permissions and release reconciliation checks remain intact.

Validation: 84 focused release/preview tests pass, including 22 new tests that execute the actual workflow loaders and reject altered content, mutable refs and API failures before executing code. Actionlint 1.7.12, scoped Vite+ 0.3 formatting/lint and commit hooks pass. Both loaders also verified and loaded the actual GitHub response at immutable commit 032cfce27518162322f7a18ee6e3bae63a057a43 (12,523 bytes; blob 9110dd07f44f5092faedaefda2dea37334843f96), stopping before any publication or cleanup operation. No preview label, artifact build or release publication was triggered. Independent review completed; final CI remains the landing gate.

Follow-up for #528; tracked by #526.

Implemented and reviewed by GPT-6 agents in the Codex harness.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pylon-marketing	Ready	Preview	Sep 12, 2026 4:56pm UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.0 KiB	13.9 KiB	−146 B (−1.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	+5 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.7 KiB	−151 B (−2.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.8 KiB	58.0 KiB	−866 B (−1.4%)	66.4 KiB	✅
Codex	Live turn messages	9	8	−1 (−11.1%)	21	✅
Claude	Total thread wire	14.0 KiB	13.9 KiB	−120 B (−0.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	+5 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.8 KiB	6.7 KiB	−125 B (−1.8%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.7 KiB	58.8 KiB	−884 B (−1.4%)	66.4 KiB	✅
Claude	Live turn messages	9	8	−1 (−11.1%)	21	✅

Baseline: 032cfce · PR result: fd3f849 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.7 KiB
• Claude decoded thread snapshot: 116.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.