Disambiguate pending test-status guard failures without weakening validation #394

Evidence

Container run 39523373357, job 118972315905, failed at 2026-10-21 00:47 UTC with The current workflow attempt is not running. Four production-consumer jobs passed; the main test matrix was skipped after the pending publisher failed.

At DevTools main e81c4600043b8cf38a57f7cbcf274308edbc2582, .github/workflows/tests.yml uses the same exception for run-ID mismatch, repository mismatch, invalid/different attempt, and non-running status. The REST response was not logged, so the underlying mismatch is undetermined; eventual consistency is only a hypothesis, not a diagnosed cause.

Scope

• Emit a distinct static, sanitized diagnostic for each failed condition, without dumping API payloads, tokens, or environment values.
• Test the actual embedded publisher with deterministic API fixtures for all guards, asserting failure before any status write, and retain a valid-path case.
• Preserve exact validation, ordering, permissions, triggers and publication behavior. No retry, bypass or relaxed guard.

Related: isolated publisher introduced in #362; future ownership in Testing #380. This is an observability correction, not a claim that the original fail-closed outcome was wrong.