fix(release): finish dx-corp/code ownership migration

[haasonsaas]

Summary

Restore the remaining release controls after the organization and public repository rename. Tag admission, signed staging checks, retry dispatch, and alpha/beta publication now recognize dx-corp/code; public provenance accepts dx-corp/mono and retains former-owner links as migration aliases. Existing protected-history, immutable-source, signing, and registry checks remain enforced.

Merged current main to preserve the stable-release guard repair already landed in #1156, and fixed the preview-channel guard identified in review.

Source repair: https://github.com/dx-corp/mono/pull/9355
Legacy source alias for the base-branch provenance guard: https://github.com/evalops/mono/pull/9355

Validation

• 105 release, tag-admission, channel, publication-propagation, and source-provenance tests passed; the prior missing-index timeout case also passed.
• node .github/workflows/check-release-workflow-contract.mjs passed.
• actionlint -pyflakes= passed for the four changed workflows.
• git diff --check passed.
• Updated-head required provenance and review-thread checks passed, as did protocol contracts, CI contracts, workflow tooling, and PR validation.
• Optional Linux CI fails in the unchanged scripts/update-lifecycle-contract.test.mjs because the release workflow retains maestro-web-dist packaging. Those references are identical on current main 0eb6f85ad2ac286e49134dc46126617e233d432a; this PR changes only its repository diagnostic. This pre-existing release packaging inconsistency needs a separate fix.
• Broader native build/test jobs remain pending. Changes are limited to release-control workflows and their contract tests; native runtime behavior is unchanged.

Risk / rollback

Incorrect repository identity blocks release admission. Revert the squash commit to roll back; doing so restores obsolete guards for the previous repository identity.

[github-actions]

This PR changes mirrored Maestro source files in the public repo, but it does not link the matching private source-of-truth PR.

Link the matching evalops/mono source PR (legacy maestro-internal links remain accepted), then re-run the check:

• https://github.com/evalops/mono/pull/<number>
• evalops/mono#<number>
• maestro-internal#<number>

Mirrored files touched:

• scripts/tag-release-contract.test.mjs

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T22:34:38.890686Z	00432e0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 00432e06c1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.