One-shot image publishers should bind authorization to a commit, not a hard-coded PR

Observation (2026-09-08 UTC, source: theft COR-4082 implementation and GitHub PRs #807/#809): the PDF417 image publication workflow required its authorized PR number to be hard-coded in the workflow itself. After the application fix was merged, publishing the resulting image therefore required a second workflow-only PR merely to change that number and obtain an exact-head release receipt. The existing same-repository, staging-base, maintainer-label, and exact-head guards worked and produced an auditable artifact, but the self-referential PR-number edit added avoidable review/deploy churn. A reusable improvement would preserve all current guards while allowing a maintainer-authorized source commit/digest to be selected without editing workflow code—e.g. a protected manual dispatch that verifies the commit is reachable from staging and records the immutable subject in the receipt. This is a design observation, not a report of current deployment status.