fix(ci): restore visual acceptance publication

[cixzhang]

Why

The required visual-acceptance gate can still strand stable-visual PRs after #5587 fixed its source run/attempt identity and granted PR mutation permission:

• The initializer still deletes visual-approved itself. That mixes the lightweight head-status initializer with advisory PR mutation and requires broader credentials than classification needs.
• Trusted recapture still attempts to replace reserved GITHUB_SHA. GitHub keeps that value bound to the publisher workflow, so immutable evidence can record the publisher commit instead of the captured PR head.

#5162 exposed the initializer failure after #5578 made the context required.

What

• Reuses fix(ci): preserve trusted visual run identity #5587's ASTRYX_VISUAL_RUN_ID / ASTRYX_VISUAL_RUN_ATTEMPT implementation and extends it with ASTRYX_VISUAL_SHA rather than duplicating the identity helper.
• Keeps the initializer limited to read access plus commit-status writes.
• Moves head/rerun label invalidation to the existing trusted workflow_run publisher and gives only mutating jobs pull-requests: write.
• Preserves success for no-scope and clean captures without requiring an acceptance record.

The immutable gh-pages acceptance record remains authoritative. Statuses, comments, and visual-approved remain derived projections. Fork code is downloaded only as a static Storybook artifact and never receives write credentials.

Verification

• Full visual-gate suite: 13 files, 118 tests
• actionlint on all three visual-acceptance workflows (with the repository's custom runner label allowed)
• pnpm check:repo
• Exact #5162 artifact dry-run: trusted publication derives 18 shots with 16 additions and no failures; state is correctly pending:decision, then an isolated immutable acceptance for PR/head/run 5162 / 66ef14d69ed5f32c469c78cb2e8395bfe23ec633 / 33041576630/1 produces success:accepted with 16 archived AFTER hashes.

The live #5162 capture is not a zero-diff capture: it still needs explicit visual acceptance after this process fix lands and its trusted publisher is rerun.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
astryx	Ready	Preview	Aug 27, 2026 6:41am

[github-actions]

PR Analysis Report

📚 Storybook Preview

View Storybook for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

🧪 Sandbox Preview

View Sandbox for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

No new or modified components detected.

Bundle Size Summary

No component packages changed.

Accessibility Audit

Status: No accessibility violations detected.

---

_{Generated by PR Enrichment workflow | Storybook | Sandbox | View full report}

[cixzhang]

Thanks, this looks good. The trusted publisher keeps PR writes, and the ASTRYX_* identity fixes the source-run mismatch. Approve once undrafted.

[Reviewed by Robohands]

[cixzhang]

Thanks, this looks good. The trusted publisher now owns label writes, and ASTRYX_* keeps recapture identity tied to the source CI run.

[Reviewed by Robohands]

[cixzhang]

Thanks, still looks good after the #5587 rebase.

[Reviewed by Robohands]