#963 Harden same-day release retry identity and record recovery

Summary

• harden the same-day Auto Release retry guard to recognize both GitHub's normalized github-actions login and canonical github-actions[bot] identity
• prevent repeated issue-close events from missing the trusted current-day marker and rerunning an older failed tag workflow
• persist the production recovery and regression evidence for pm-l5bc03

Verification

• focused workflow contract: 12/12
• live issue #959 marker selection: pass
• full repository coverage: 468 files / 7,142 tests, exact 100/100/100/100
• ESLint: zero warnings
• jscpd: zero clones
• static docstring/package/replication/token/context/tracker/surface gates: pass
• pnpm changelog:pm:check: pass

Production evidence

PR #961 delivered the broad SDK/CLI tranche and PR #962 recovered the immutable tag. Release run 31377907853 published v2026.8.10; npm, npx, bunx, MCP, installed npm/Bun sessions, Sentry, and telemetry verification passed. The recurrence run 31379212377 created no tag or package but exposed the normalized Actions-login mismatch fixed here.