TokenPak v1.3.6

Fixed — release-gate hotfix-3 (pin validity + preflight coverage)

Recovers from a third release attempt that failed before publication (v1.3.5). Content identical to v1.3.3 through v1.3.5 plus two narrowly-scoped fixes; the preflight added in v1.3.5 is now extended so the same bug class cannot burn a tag again.

• release.yml SHA pins corrected — two of the five pins ported from publish.yml during F-01 were invalid SHAs (not the actual tag commits):

  • actions/download-artifact@fa0a91b85d4f404e444306234a2a8284e0a91ef9 → @fa0a91b85d4f404e444e00e005971372dc801d16 (the real v4.1.8)
  • pypa/gh-action-pypi-publish@76f52bc884231f62b3a5c8ae4dab2bd50e2e5720 → @67339c736fd9354cd4f8cb0b744f2b82a74b5c70 (the real v1.12.3)

  Both verified via git ls-remote --tags against the upstream repos. The three other F-01 pins (actions/checkout@v4.2.2, actions/setup-python@v5.3.0, actions/upload-artifact@v4.6.0) are valid and unchanged.

• New validate-pins preflight job in release.yml. Runs before test on both push:tags and workflow_dispatch. Uses git ls-remote --tags to resolve every SHA-pinned action to its upstream commit and fails fast if any pin diverges. Closes the gap that let v1.3.5 burn — the prior preflight gated release + publish out of dispatch runs, so SHA pins in those jobs were never exercised before a real tag.

Why three burned tags

v1.3.3 → v1.3.4 → v1.3.5 each revealed a distinct release-path bug that the preceding preflight did not cover: conformance tests needed a registry checkout; the CLI smoke step used a non-executable module path; a Python 3.12 tempdir race; and finally two invalid SHA pins. Each fix closed a class. v1.3.6 adds the preflight that would have caught the SHA class before any of them.

No scope expansion

No TIP-SC semantic changes. No runtime behavior changes. No unrelated cleanup. No broader workflow redesign beyond the pin fixes + the single validate-pins job.