Restore component release recovery for authoritative RC foundations

[rmcdaniel]

Scheduled Release plan recovery runs now reject the current coherent RC release plan with release plan does not name the proven immutable candidate foundation. The selected plan is the published release authority, but component recovery consumers still recognize only an older candidate foundation. This leaves the independent GitHub recovery path red even though the declared RC artifacts are public.

Acceptance criteria

• Every release component can resolve and verify the same current authoritative RC release plan without weakening immutable plan or source identity checks.
• Candidate-foundation verification follows the authenticated authority of the selected plan and still rejects substitutions, malformed identities, and unapproved plans.
• A scheduled recovery run with no eligible work records a neutral no-op instead of failing.
• Public recovery workflow evidence is green for Workflow, Waterline, Server, CLI, PHP SDK, Python SDK, and Rust SDK against one plan identity.

Delete when

Delete when all seven component recovery surfaces independently resolve the current RC plan, verify or safely skip their exact declared artifacts, and retain negative coverage for invalid foundation authority.

Required source targets

durable-workflow/.github@main
durable-workflow/cli@main
durable-workflow/sdk-php@main
durable-workflow/sdk-python@main
durable-workflow/sdk-rust@main
durable-workflow/server@main
durable-workflow/waterline@v2
durable-workflow/workflow@v2

[rmcdaniel]

Cross-repository landing evidence (generated from trusted implementation pull requests or authenticated protected-branch completion records):
Completion source: fde81246976ca5fcb4262f4523ba1a95921f1440

Target	Latest attempt	Bound provenance	Landing	Required qualification	State
durable-workflow/.github@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	fde81246976c	Passed: Control-plane source qualification (check run 30434364948); cited qualification: legacy generic qualification cited run 30422625494	complete
durable-workflow/cli@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	cc7276826156	Passed: Target branch qualification (check run 30422465386); cited qualification: legacy generic qualification cited run 30422465374	complete
durable-workflow/sdk-php@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	81ddba724116	Passed: Target branch qualification (check run 30421736826); cited qualification: legacy generic qualification cited run 30421736918	complete
durable-workflow/sdk-python@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	b736047c8259	Passed: Target branch qualification (check run 30423166223); cited qualification: legacy generic qualification cited run 30423166237	complete
durable-workflow/sdk-rust@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	75ff795c3ff9	Passed: Target branch qualification (check run 30422051562); cited qualification: legacy generic qualification cited run 30422051567	complete
durable-workflow/server@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	fafbe044d691	Passed: PHPUnit feature suite (check run 30423875823); cited qualification: legacy generic qualification cited run 30423875810	complete
durable-workflow/waterline@v2	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	fbf82b5558f3	Passed: Target branch qualification (check run 30423878966); cited qualification: legacy generic qualification cited run 30423879020	complete
durable-workflow/workflow@v2	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	2c7c48c5d76e	Passed: build (check run 30422074432); cited qualification: legacy generic qualification cited run 30422074449	complete

Every declared target landing and required repository qualification is complete.

[rmcdaniel]

Completed in fde81246976c on main.

Required public qualification passed: https://github.com/durable-workflow/.github/actions/runs/30422625494

Required cross-repository target qualification passed:

• cli:main at cc7276826156 (qualification)
• sdk-php:main at 81ddba724116 (qualification)
• sdk-python:main at b736047c8259 (qualification)
• sdk-rust:main at 75ff795c3ff9 (qualification)
• server:main at fafbe044d691 (qualification)
• waterline:v2 at fbf82b5558f3 (qualification)
• workflow:v2 at 2c7c48c5d76e (qualification)