[webmaxru]

Summary

• Add a trusted, content-only approval controller with exact-head review or owner self-approval command, preflight, SHA-guarded merge, and explicit release chaining.
• Publish immutable-tag draft releases and PDFs from the validated merge; support authorized exact-tag recovery and prevent older editions becoming latest.
• Request and verify the legacy GitHub Pages build explicitly after pushing the PDF-free site, instead of relying on a GITHUB_TOKEN push event.

Validation

• Python unittest suite: 127 passed; additional current approval, Pages, workflow and real subprocess fixture tests passed.
• Workflow YAML parsed; git diff --check passed.
• No production merge, release, Pages build or workflow dispatch was performed. The live legacy Pages build API and pages: write token behavior must be verified after human review; failures are surfaced rather than treated as deployment success. actionlint was unavailable locally.