[scbrown]

The v0.30.0 release completed its ordinary publication but then failed after roughly 40 minutes waiting for a repository pendant whose trusted producer was not admitted (run39961801702). Port the admission/readback split from yupana#184: unset, empty or false reports NOT_ADMITTED without downloads or waits; exactly true runs the existing bounded public-byte verifier; malformed values fail.

The workflow always reports admission, then gates readback on that output. Admitted missing assets, corrupt checksums, incorrect repository/source/tag provenance and unsafe archive members still refuse. Historical scbrown/bobbin provenance identity remains unchanged. No producer, repository variable, credential, release dispatch, upload or publication gate is enabled. NOT_ADMITTED is not pendant verification or publication success. Rollback is reverting this source change.

Validation: 15 publication controls, 4 query controls and 11 knowledge controls (one existing skip), plus release workflow, crates and provenance contracts pass. Both candidate and inverse runs leave all 157 HOME paths and five watched resources unchanged. The three new controls against the original verifier/workflow fail as expected, including an observed forbidden read. No Rust source changed; no native build or live producer exercised.

Demo (source fixture transcript, not deployed behavior): run python3 scripts/test-repository-share-publication.py Publication.test_unadmitted_release_makes_no_read_or_wait. At base fddcdb7 the unchanged new test fails with unadmitted release attempted a read or pause; candidate f0bbf76 returns NOT_ADMITTED with zero reads or pauses. The admitted control verifies an actual synthetic archive and rejects a corrupted checksum. Terminal-video tools asciinema/vhs are unavailable; this is a repeatable text demonstration, not inline playback.

Natural release acceptance stays open: observe the admission report on a future normal release containing this source (or exact public bytes if independently admitted). Retain the historical red run; rerunning an old tag does not test this new script. Refs aegis-5dkx; coordinated with the existing repository-pendant rollout. One non-author review after complete green; Tim lands.