Add the default-off release-recovery publication workflow #717

🤖 Generated by the Agentic Engineer

Problem

Once the publisher command exists, operators still need a reviewed, default-off way to run it in the affected repository without rerunning release plugins or widening credentials (#602).

Smallest useful change

Add a default-off reusable recovery workflow that calls the publisher command:

• It runs only in the affected public repository on its default branch, sharing the normal release concurrency group.
• It builds the publisher from immutable catalogue code before any credential is issued.
• It admits the incident with a one-repository read token. It stops as a verified no-op when the publication already exists, before any writer token is minted.
• Only then does it mint a token with Contents(write) and Actions(read) for that one repository.
• It keeps a permanent, explicit operator confirmation separate from the temporary rollout flag. Production publication is manual-dispatch only.

Acceptance criteria

• Default-off and explicit enabled/offline CI calls run without production credentials. Every reusable caller is covered by the required aggregate.
• Workflow-authority guards cover scoped permissions, immutable source and the order of read token before writer token, with negative controls.
• Operator documentation is written, reviewed, merged and released.
• Rollout and removal of the short-lived flag are tracked as separate open work (Complete release-recovery rollout and decide the opt-in lifecycle #603) before the flag ships.

Depends on

The publisher-command child of #602.