Retire the previous github-config publisher approval #5117

🤖 Generated by the Agentic Engineer

Objective

Retire the previous canonical signing approval for the organization configuration publisher after the replacement publication has verified and reconciled.

Details

Platform #5092 prepared a two-revision transition. The replacement caller merged in shared automation #649. Real release v7.20.3 was published by run 39383262486, attempt 1, from source 3f78fb69353cadf5cadb970b96d1d6b2aa0fdacb. Independent Cosign verification binds its digest to the exact replacement publisher revision 8d2203af130a8c27b8b98b3d7146f76b5ade7a98; production verification and reconciliation of that same digest passed.

The transition approval still includes canonical revision e1681322e671f8e277c5e230a57fe66cdf1a612d alongside the replacement. Removing that transition entry is a separate reviewed change. This issue changes no approval or production resource.

Checklist

• Re-read current caller pins, published signature annotations and deployed source acceptance; confirm no current consumer requires the retiring canonical entry.
• Remove only the superseded .github/publish-manifests canonical entry using the existing approval and generation procedures. Preserve the replacement, every other consumer and independently required legacy-family compatibility.
• Regenerate the matcher and production authorization evidence through their existing writers; retain issuer, repository, workflow and immutable-revision boundaries.
• Prove the replacement remains accepted and the retired canonical identity is rejected, alongside unrelated issuer/repository/revision negative controls.
• Obtain exact-head review, use the normal protected delivery path, and independently verify the deployed acceptance rule and a healthy current artifact afterward.

Dependencies

Follows #5092. Its publication prerequisite is now evidenced; re-verify it when this work is pulled.

Notes

Small source change with full protected deployment and readback. Risk reduction is retiring completed transition compatibility. Refine priority against current portfolio work; no new implementation is started while downstream WIP is saturated.