fix(security): harden scope, trust, and release boundaries

[jeremi]

Summary

• enforce uniqueness across effective Registry API authorization scopes and prevent attribute-release privileges from aliasing lower-sensitivity scopes
• make a configured Relay PostgreSQL state-plane root certificate an exclusive trust anchor while preserving normal system trust when no custom root is configured
• stop executing downloaded release binaries in the GitHub publication job that holds contents: write and OIDC permissions
• run release-capsule backfills from exact default-branch code through repository_dispatch, with checkout credentials disabled

Component reviews

The final integration keeps the original three signed commits while each independent owning area has a narrow review unit:

• fix(registryctl): isolate attribute release scopes #474: registryctl authorization-scope isolation
• fix(relay): pin state-plane trust root exclusively #475: Relay state-plane trust-root pinning
• fix(release): harden privileged workflows #476: release and privileged-workflow hardening

The component PRs are review-only stacks and should not be merged separately. This PR remains the single final merge to main after those reviews complete.

Why

A security review identified four boundary failures: authored scopes could collapse distinct capabilities, a configured private database root was additive to system trust, downloaded build artifacts were executed in a privileged publication job, and the backfill workflow could run branch-selected workflow code with write authority.

The changes apply the smallest controls at those boundaries. They do not broadly restrict reviewed project configuration or add unnecessary operator approvals.

User and operator impact

• project authors receive actionable scope-collision diagnostics
• multiple attribute-release profiles may still intentionally share the entity-bound release scope
• Relay deployments that omit root_certificate_path continue using the host system trust store
• capsule backfill moves from the GitHub UI to the documented one-command gh api invocation so privileged implementation always comes from the default branch
• release binary version validation remains in read-only producer jobs

Validation

• cargo fmt --all -- --check
• cargo test --locked -p registryctl (291 passed)
• cargo clippy --locked -p registryctl --all-targets -- -D warnings
• cargo test --locked -p registry-relay --lib (719 passed, 6 ignored)
• cargo clippy --locked -p registry-relay --lib --tests -- -D warnings
• just ci-preflight in crates/registry-relay
• python3 -m unittest release/scripts/test_registry_release.py (66 passed)
• python3 -m unittest release/scripts/test_check_release_source_model.py (12 passed)
• actionlint .github/workflows/release.yml .github/workflows/release-capsule-backfill.yml
• git diff --check

Two independent implementation reviews found no actionable code issue. The component PRs provide the requested owning-area review split.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 69311802dc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".