[JesseRaber]

An approved release can finish through one owner-run PowerShell helper when the agent session cannot perform the remaining actions. It verifies the reviewed PR, checks, tag workflow, notes and assets before publication, then re-verifies and files published assets.

The review fixes make the helper fail closed:

• Require the reviewed head on initial runs and resumes, the expected base, matching predicted/actual merge trees and successful required CI. Missing, pending, skipped and neutral checks are not passes.
• Preserve approved repository visibility and immutable-release policy; verify exact-tag workflow success, reviewed notes, expected title/author and downloaded assets, including a fresh check immediately before publication.
• Reject malformed/duplicate checksum entries and filing conflicts before remote actions. Permission failures do not become missing tags; uncertain outcomes must be reconciled.
• Remove the arbitrary post-release command hook because it could repeat installations or other side effects on retry. Already-approved named-host installs continue separately with their own verification.
• Require an approval reference for unattended use; preserve mandatory host/platform confirmations. Dry runs report planned steps and do not certify an unexecuted release gate. Retain temporary evidence for recovery.

Validation:

• 90 local tests pass, including 16 offline orchestration tests covering simulated merge/tag/publication and completed-run recovery, plus failure controls. Process/network boundaries are mocked; no actual merge, tag push or publication is executed by these tests.
• Version/notes/record/workflow checks pass. Six local candidate packages build and verify. Version remains 1.2.0; the PowerShell helper remains omitted from Gemini, Copilot and Opal packages.
• Hosted CI must pass on the current PR head before any later merge decision.

Boundary: review fixes and CI only. Do not merge, tag or publish from this task. A fresh installed-host candidate trial and the later exact-merge/tag/draft/published gates remain unexecuted for this revised candidate; no release-gate PASS is claimed.