v0.2.20

refactor: share attested runtime loading and guard version reuse (#93)

## Summary

- Share the runtime loader between the reusable workflow and the client action.
- Keep native GitHub attestation verification before extraction, then use the attested Rust CLI to validate the source manifest, canonical tag/release, and archive digest and size.
- Remove duplicated shell TOML/SemVer parsing and keep runtime validation in Rust.
- Reject PRs whose package version does not increase over the base or already has a tag/release. Bump Cargo.toml and the package lock entry to `0.2.20`.
- Document the loader ownership and its bounded 1,000-release lookup window.

## Validation

Reviewed head: `c8283154855770df3ffac48af263d02010d03400`, based on protected main `4c5dc66e855b03715a161b5166f5a132addb3084` (verified GitHub signatures).

- Rust 1.99.0 format check, locked full tests (232 passed; 2 ignored), clippy with warnings denied, pinned actionlint, and diff check passed for the assembled change.
- [Current-head independent automated review: PASS+NOTES](https://github.com/civitaspo/securefix-server/pull/93#issuecomment-6209932648). All 12 remote blobs match the reviewed tree; exact-base patch ID `53523d64d4dc1a247a15ac104d75d497eb2025da`. Same-model independent review.
- [Current-head Actions CI](https://github.com/civitaspo/securefix-server/actions/runs/38864052937) passed, including the runtime version gate and required status-check.
- The prior candidate prepare failed: local candidate actions eagerly resolved nested `$/` against the producer revision, and rebasing the old owner fixture left duplicate `/approve` comments. The shared native bootstrap is now one `load.sh` called through each action's own `github.action_path`; the client runs the sibling script only for published-runtime mode. Loader success/rejection and workflow wiring tests pass. A fresh fixture avoids duplicate commands.

## Promotion status

PR #92 was merged at `4c5dc66` after explicit owner authorization for a temporary owner-only ruleset exception. Both original rulesets were restored and read back; default-branch protections were unchanged. The resulting protected main declares `0.2.19`, removes Nagi, and retains the API retry change. [Main CI passed](https://github.com/civitaspo/securefix-server/actions/runs/38861140153).

Normal [Publish Runtime for 0.2.19](https://github.com/civitaspo/securefix-server/actions/runs/38861429045) and [all nine actual caller distribution jobs](https://github.com/civitaspo/securefix-server/actions/runs/38861576545) passed. The canonical lightweight tag and release target match protected main; archive identity and digest match publication evidence.

Candidate head `740de55` completed prepare (including real client Action) successfully. Verify exercised all scenarios successfully, including native auto-merge, then failed cleanup because GitHub had already auto-deleted the merged branch (DELETE 422, exact ref GET 404). The shared Rust cleanup helper now accepts 422 only after confirming that exact ref is absent, and only reserved integration-fixture cleanup paths reuse it; release-branch cleanup is unchanged from the base. Three focused tests cover success, absent refs, conflicts, permissions and invalid names.

The existing main workflow completed [candidate prepare](https://github.com/civitaspo/securefix-server/actions/runs/38864168162) and [verify](https://github.com/civitaspo/securefix-server/actions/runs/38864541393) successfully for exact head `c828315`. Verified paths include real client artifact/label dispatch, current-head approval, native auto-merge waiting for policy and then merging, stale-head/replay rejection, actual pinact/status checks for generated workflows, repair/tag idempotence, feedback lifecycle, and fixture cleanup.

Four scratch event handlers were restored to their original active states after verification. The preexisting disabled release-pr-sync and PR105 were preserved. All run-owned fixtures and branches were cleaned, including owner approval fixture PR150. Intermediate failed/cancelled runs remain documented above and were not used as promotion evidence.

Normal owner `/approve` was captured at [run38864937980](https://github.com/civitaspo/securefix-server/actions/runs/38864937980) and applied at [run38864987002](https://github.com/civitaspo/securefix-server/actions/runs/38864987002). Current-head bot review and the App-bound policy check succeeded. Normal `/merge` was posted after rechecking exact head/base, review, and required checks; the ordinary merge workflow is processing it. No protection exception is used for PR93.

Final `0.2.20` publication, all-nine caller distribution, and the post-publication published-client rehearsal remain pending. The locator caps pages and projected IDs; full release-page response memory is not capped (reviewer's low-severity availability note).