fix: remove the one-time v0.1.1 recovery path

[tensornull]

Summary

• remove the one-time v0.1.1 main-dispatch recovery inputs, fixed evidence identifiers, prior-artifact reuse, live-smoke reuse, and temporary branch-policy handling
• restore the permanent Release Please handoff to an immutable-tag-only verify/live/OIDC path
• constrain npm provenance and Environment validation to stable v0.1.x tags and the sole tag:v* policy
• seal the parsed Publish workflow contract and add adversarial mutations for main-ref, gate, step-control, provenance, stale-branch, and recovery reintroduction bypasses
• replace the executable recovery runbook with the permanent release contract

Root cause

The one-time recovery was intentionally scoped to publish the already immutable v0.1.1 artifact after the historical tag could no longer execute the repaired workflow. Leaving that branch in the permanent workflow would retain a main-context publication surface and reusable fixed release evidence.

Impact

Future stable patches can publish only through the normal chain:

Release Please result → unprivileged handoff → immutable tag dispatch → fresh verification/live smoke → npm OIDC

The npm Environment remains tag-only. This PR does not change package versions, release manifests, Release Please configuration, tags, releases, npm ownership, Trusted Publisher configuration, secrets, or Environment settings.

Verification

• npm ci
• npm run verify
• npm run actionlint
• 477 local tests plus the complete copied standalone repository verification
• minimum, locked, and latest compatible OpenAI 6.x fixtures
• publint and Are the Types Wrong
• independent adversarial review: 173 targeted and 763 generated workflow mutations rejected
• git diff --check