Restore complete publisher observations after AWS and Khoist caller transitions #5267

🤖 Generated by the Agentic Engineer

Problem and evidence

The genuine publisher observation refresh currently exits 1 with two of five consumers unresolved and writes no files. Both unresolved callers pin canonical publisher revisions that their platform consumer approvals do not yet accept:

• AWS: publish-manifests at 3bc75c3a147f40ccdfee9a63602d15570f8af3b1, introduced by chore(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml from 7.2.10 to 12.0.2 aws#59.
• Data-product-controller/Khoist: publish-app at 6f1dee9557a939cc24ca2c562ea775d05e01564d, introduced by chore(deps): bump devantler-tech/.github/.github/workflows/publish-app.yaml from 7.23.0 to 12.0.1 khoist#488; the current caller still uses it.

Reproduced with the normal observation generator against a working production read context. Its refusal preserves the previous observation files. #5265 repairs the separate organization settings publication failure; its narrow repair leaves these consumer approvals unchanged.

Expected outcome

Restore complete, genuinely observed publisher records while retaining the explicit consumer and workflow approval boundaries.

Acceptance criteria

• Review each new publisher's executable source and bind its current caller pin and applied publication to exact workflow revisions.
• Prepare each justified consumer-specific approval transition through the existing procedure; retire an older approval only after proving no current publication needs it.
• Prove retained/new approvals and the unrelated-consumer, issuer, repository, mutable-ref and retired-revision rejection controls.
• Deliver any acceptance-rule changes through independent review and the protected path, then verify the deployed rules and publication state.
• Run the unchanged genuine observation generator successfully for all five consumers and verify a repeat is stable on unchanged inputs.

Size: medium; refine the independent consumer transitions before pulling implementation work.