[devantler]

The AS Coaching semver source selected a valid tenant release signed by a newer immutable revision of the platform-owned publish workflow, but the platform matcher allowed only the two revisions recorded in its generated approval set. Production reconciliation then waited 30 minutes and failed even though the release stayed inside the platform's existing tenant boundary.

This change declares AS Coaching and Wedding as trusted application release streams. Their matcher now requires the exact GitHub OIDC issuer and exact devantler-tech/actions/.github/workflows/publish-app.yaml path at an immutable 40-hex commit, while .github and AWS remain bound to their generated exact revision sets. The writer preserves that distinction, and enforcement rejects a concrete revision pair on a trusted release stream because it would recreate the per-release platform approval gate.

The platform continues to govern package source, namespace, RBAC, network, and admission-policy boundaries. A tenant release can move freely within those bounds; additional authority still requires a reviewed platform change.

Validation:

• bash scripts/tests/test-write-publish-workflow-matchers.sh
• bash scripts/tests/test-publish-workflow-approved-revisions-guard.sh
• bash scripts/tests/test-shared-publish-workflow-pin-guard.sh
• bash scripts/guard-shared-publish-workflow-pin.sh
• shellcheck -x on the changed matcher scripts and tests
• go test ./scripts/validate-eks-ci-role-policy
• real-tree matcher regeneration is a byte-identical no-op

Fixes #3699