PR-bound image release gates must run before merge

Observed 2026-09-08 in e3-solutions/theft while checking COR-4082 / PR #805. The PDF417 GHCR publication workflow is a one-shot pull_request:labeled gate bound to an exact PR number and head SHA. PR #805 was squash-merged before the publication label ran, leaving neither its reviewed head e4afd23c… nor merge commit fe1204bb… with a scanned image receipt or registry tag. Because the workflow publishes only a PR head and the merged commit is not a PR head, the safe recovery is a reviewed follow-up artifact-only PR from staging: update the workflow’s expected PR number to that new PR, then have a maintainer apply publish:pdf417-engine once to the reviewed exact head. Operational lesson: make the immutable-image receipt an explicit pre-merge gate whenever a source change requires a host image. Provenance: repository workflow/docs plus read-only GitHub Actions, artifact, PR, and GHCR package metadata.