Workflow release recovery rejects the landed CLI recovery source

[rmcdaniel]

Status Summary

workflow:v2 at 074181ae7edd5ac1fa5a4544999d68cc210bfdfc pins the CLI release-recovery workflow to SHA-256 adb0f4d27fd4f933227de5bd04e1fbe438f14c9f7ca85c300d47cc304a669b00. The landed cli:main source at f96ada82cb211172604a60f5737705e0fe9ed23d has SHA-256 de1e7f37bcbadf3644b53d127abcae11ec823fd6602a682a58617c6b257dae11 because its protected-main guard also covers the discovery job. The verify_plan_authority function therefore fails default-branch-preflight while checking the public CLI recovery workflow, so release-plan recovery is not independently runnable.

How to fix

• Refresh the Workflow CLI recovery fixture and exact approved digest from the landed protected cli:main source.
• Preserve exact-source verification and the protected-main guard; do not weaken the digest check to source-pattern matching.
• Add focused coverage that keeps the fixture, approved digest, and accepted protected recovery source aligned.
• Recheck the complete public target-branch recovery tuple after all peer recovery changes land.

Delete when workflow:v2 release-plan preflight accepts the exact landed CLI recovery workflow, continues to reject modified or unprotected source, and the full public target-branch recovery tuple passes preflight.

[rmcdaniel]

Source implementation landed in e02a0ad574bb on v2.

Required public qualification passed: https://github.com/durable-workflow/workflow/actions/runs/29965033922

This issue remains open until its required public completion evidence is verified.