[vitormattos]

Scope

• Pin release-tool composite Actions in the organization release workflows and App Store publisher to the published immutable v0.12.0 commit 51355769089a6796c23d6c966108afbdaf858c32.
• Keep application packaging/signing on its Nextcloud-supported PHP version; the release-tool composite Actions themselves provision PHP 8.5 immediately before invoking the PHAR.
• Remove the publisher's redundant PHP setup and the additional checks that compared an immutable Action to the current catalog main or to the latest release at runtime. Older valid release workflows are no longer blocked solely because a newer release-tool version exists.
• Retain static tests validating consistent immutable release-tool pins and the correct signing/validation order.
• Pin the thin downstream publishing template to the simplified publisher Action at 8828d1047c31ac1c6bf1998436b2a73e7e5c6288.

Review focus

• No live GitHub lookups for catalog/release freshness on the publication path.
• The PHAR runtime remains PHP 8.5 via each release-tool Action, independent of app runtime selection.
• The existing manual recovery, tag/source safety and immutable Action pins remain intact.

Verification

• GitHub CI: 5 checks passed for current head (Python tests, policy, actionlint, zizmor, DCO).
• Published release-tool v0.12.0 PHAR/checksum had been verified in the migration.
• All new commits signed via Git Signing MCP and DCO-compliant.

Merge coordination

Review and merge this catalog PR before the prepared LibreSign PRs #9359, #9361, #9362, #9363, which pin the reviewed publisher Action and have updated catalog lock provenance. No bypass of required reviews.