Maintain v0 only from verified published 0.x releases #11

Outcome

Implement the owner's selected GitHub v0 channel and released-major update workflow, following the existing php-fast-forward/changelog design. Related release lifecycle: #6. This is a separate increment from bootstrap PR #7; no channel exists or is created by this issue.

Acceptance

• Consumer wrapper uses @v0, not a fabricated full release or placeholder.
• Bind tool/helper checkout to the called workflow's actual repository and SHA from the executing job context, never resolve the moving branch a second time.
• Bootstrap and own repository CI work before v0 exists. No circular dependence on a future release.
• Create/advance only after a real published stable 0.x release is verified against the exact expected commit. No 1.x or manual tags/releases.
• Compare-and-swap exact old OID (including zero for creation), fast-forward protection, monotonic complete release catalog, conflicting same-name tag rejection and idempotency.
• Recheck release/ref evidence before mutation; uncertain result requires actual-ref readback. Never force or replace foreign refs.
• Wire channel update directly to successful Changelog publication outputs; do not depend on a token-generated release event starting another workflow.
• Preserve explicit publication authority and current-head checks, Codex AND CodeRabbit approvals for each PR, including version PRs. No persistent permission/protection changes or credential creation. If the existing token cannot update a released ref with workflow files, report the permission gate.
• Synthetic transport and disposable Git fixtures cover refusal, races, stale selectors, recovery and no real remote mutation. Document GitHub v0 versus Composer/CPX version constraints.

Provenance

The Changelog reference uses fromJSON(toJSON(job)).workflow_repository and .workflow_sha for trusted helper checkout; its executed run metadata independently records exact referenced workflow SHAs. Reuse this execution-bound pattern, not github.workflow_sha from the consumer context.