One-shot release authorization must stay reusable without weakening exact-head binding
Observed 2026-09-07 while planning the Shield Adam PDF417 rollout from repository commit 8973feeb2b1a707a4db94ce36760d051d73dc1d9: the scanned-image workflow correctly binds publication to a maintainer-applied label and exact PR head, but also hard-codes one historical PR number.…