Revoke superseded origin-mismatch candidate

[jremick]

Summary

• revoke candidate source c7b6deff54a78ede279d607e38bfe8df2bec3582
• revoke candidate digest sha256:24658ae4bb634115c84a0a1466666a0e614aabd8dce8c8e20cba6d9562cb677d
• retain replacement source 08447e87df2e1705aa9a79193a52a65fb00724c3 and digest sha256:c1558d33b1e38c01d7d77171354464dd2b507fd6b84b353f2b0e11372ed73157 as eligible

Direct Unraid validation exposed a packaging trap in the superseded candidate: Docker Manager's WebUI shortcut opened the raw host IP while the configured Web Origin used a hostname. The exact-origin CSRF guard correctly rejected cookie-authenticated Finder search. The replacement makes direct Unraid operation IP-canonical, documents the hostname/HTTPS path, and returns actionable recovery guidance without weakening the security boundary.

Replacement evidence

• candidate-only publication passed from exact protected-main source 08447e87df2e1705aa9a79193a52a65fb00724c3
• anonymous OCI read-back and source attestation passed for the replacement digest
• exact-digest validation passed: anonymous pull, clean Docker/Compose install, published-digest supply-chain/SBOM policy, and alpha.21 upgrade with cold rollback
• MediaNAS replacement instance is healthy at the exact digest with the documented resource/security envelope
• explicit admin session and canonical raw-IP Finder search returned 200 with five results
• the hostname alias returned 403 with actionable guidance and no deployment-origin disclosure
• the prior c7b instance remained healthy throughout replacement establishment

Verification

• release-revocation schema, shape, identity uniqueness, and reason-length validation
• npm run verify:docs
• npm run build
• npm run test:packaging
• npm audit --omit=dev — 0 vulnerabilities
• git diff --check

Safety

• this PR changes only .github/release-revocations.json
• it does not create a semantic Git tag, semantic GHCR tag, or GitHub release
• it does not revoke the established replacement source or digest
• EXP remains untouched