Validate source-bound ownership before module publication #547

Context and request

Prevent module publication from taking an immutable PowerShell Gallery version before the candidate's GitHub tag, release, and asset ownership has been validated. The complete review of PSModule/Process-PSModule#531 identified that the current tag/asset preflight occurs after Gallery publication. A later conflict cannot undo that external mutation.

Acceptance criteria

• A conflicting or unverifiable tag/release/asset identity stops the candidate before any Gallery publication or other versioned-artifact mutation.
• The preflight uses the actual resolved version, immutable consumer source, and tested artifact identity; it does not guess from a moving ref, release name, or numeric version alone.
• Authentication, API, malformed-context, and ownership errors remain explicit failures rather than absent-resource or success fallbacks.
• Tests demonstrate call ordering for valid, conflicting, missing-proof, and concurrently changed claims, without publishing real artifacts.
• Gallery-only recovery consumes the same verified ownership contract; unproven existing versions cannot be reused, and independent version-selection/decision policy is not introduced.

Constraints and non-goals

Keep this a source-bound module-publication safety delivery. Do not absorb it into the bounded recovery PR, the artifact-isolation PR, or a general durable-lifecycle framework. Do not change live releases, tags, labels, permissions, or rulesets. Preserve supported caller/settings behavior; no new invocation-level DefaultBump input is implied.

Technical decisions

Reconcile the version resolver, Gallery publisher, GitHub preflight, and callable workflow under one owner. Reuse the verified recovery guard/helper contract once its candidate is frozen, without requiring an unmerged production action pin or creating a dependency cycle. The exact proof/claim mechanism and helper handoff must be established from the existing code and isolated experiments before Build. Missing historical proof must not be fabricated.

The narrower precondition-expression refactor in #325 is not this behavior change. The checksum-based, non-configurable proposal in #427 is unrefined and must not become an alternate release-decision authority.

Implementation plan

• Capture the present mutation order and demonstrate a conflicting-ownership fixture reaching Gallery publication before the old preflight.
• Resolve the frozen helper/input contract, proof sources, and minimum publication claim boundary before code changes.
• Implement the source-bound preflight ahead of external mutation while preserving valid new publication.
• Cover missing/foreign ownership, concurrent claims, API failures, and the Gallery-only recovery handoff with behavior tests.
• Update current-state guidance and put exact adoption/compatibility effects in the delivery PR record; complete existing checks and full review without live publication.