Promotion caller test rejects tracked publisher pin updates #727

🤖 Generated by the Agentic Engineer

Description

Tracked updates to the configuration publisher cannot pass the promotion contract test. The workflow pin is updated by Dependabot, but the test independently requires the previous literal SHA, so a new immutable pin fails before the publication behavior is exercised. This stalls routine catalogue updates.

Steps to reproduce

1. At 90cf3f726c28dcbcd32e0c6032ada1b9e29afdd4 in PR #725, update only the publisher call in .github/workflows/cd.yaml from v10.0.3 to v12.0.1, retaining a full commit SHA and both publication opt-ins.
2. Run bash .github/tests/test-publish-manifests-promotion.sh.
3. The opening validate_caller comparison still requires 0f390329b590404c02565b27a263ee841fa02bce, while the tracked update uses 6f1dee9557a939cc24ca2c562ea775d05e01564d.

Expected behavior

A reviewed publisher update can satisfy the caller contract without leaving an independently hard-coded old version in the test. The test still rejects a mutable or malformed ref, the wrong publisher, missing caller verification, disabled signed promotion, and the wrong artifact target. Any required verifier rollout remains a separate delivery gate.

Actual behavior and evidence

Native failed job 120313284153 tested the merge ref for that exact PR head and failed with the configuration-caller refusal. Its preceding publication contract cases passed. The stale literal remains at default-branch revision 93a788988d6c9e5b96594b07d4919a53f8b61975 after a fresh fetch; the PR diff changes only the workflow call. This is a deterministic contract mismatch, not a transient runner failure.

Acceptance criteria

• Reproduce the failure at the updated publisher pin and pass the corrected contract with RED/GREEN evidence.
• Give the caller pin and its assertion a reviewed update path that does not require an untracked literal to be changed by hand.
• Retain negative controls for a mutable/malformed ref, wrong workflow identity, missing caller verification, disabled signed promotion, and wrong artifact target.
• Run the existing signing, immutable-version, failure-ordering and recovery controls unchanged; do not skip or weaken the required check.
• Refresh fix(ci): accept publisher releases with unchanged approved contents #725 through the guarded dependency-adaptation path and collect successful exact-head hosted validation before delivery.

Additional context

Part of #627. Rough size: S–M, including contract controls and exact-head hosted validation. Audience: catalogue maintainers and all consumers waiting on routine publisher updates. This issue captures the failing contract; the wanted dependency update stays open.