Release recovery is blocked by unrelated branches retaining the published version #22

The live v0.2.3 recovery exercise stopped in the tokenless build job before either publish or persist-provenance could run.

Failure:

AssertionError: Package version 0.2.3 already exists at abace680192e with different artifact inputs; bump the version

Cause:

• scripts/artifact-provenance.mjs implements assertVersionIsUnambiguous() with git log --all -- package.json.
• Dependabot opened PR build(deps-dev): bump typescript from 5.9.3 to 7.0.2 #10 from abace680192e after the release. That branch correctly retains package version 0.2.3 while changing TypeScript/package-lock inputs.
• A fresh release runner fetches that remote branch, so --all treats an unrelated, unmerged dependency branch as historical reuse of the released version.
• This prevents the workflow from reaching its exact-registry recovery validator and no-clobber asset recovery logic.

Impact:

• Initial v0.2.3 publication and provenance persistence succeeded.
• The failed recovery attempt stopped before credentials or immutable assets were touched.
• Release workflow reruns can be broken by any ordinary post-release branch that has not yet bumped the next version.

Required fix:

Scope version-history ambiguity to authoritative release history, not every fetched branch. On a release runner, compare the candidate against the release tag/HEAD ancestry and relevant immutable release tags. Preserve detection of a version reused on main or across release tags, but ignore unrelated PR/dependency branch heads.

Add a regression with:

1. released/tagged 0.2.3 on main;
2. unrelated branch from that commit changing a package input without changing version;
3. recovery rerun at the original tag succeeds and reaches exact registry recovery;
4. genuine version reuse on authoritative history still fails.

Evidence: release run 29864644780, failed rerun job 88751610317, Dependabot PR #10.