Authenticate release automation; never waive required gates by branch name

[forkwright]

Finding

The shared required-gate workflows trust a contributor-controlled branch-name prefix as proof that a pull request came from release automation. A PR whose head_ref starts with release-please--branches-- is therefore waived even when its author is not trusted automation.

Evidence

• .github/workflows/hybrid-gate.yml:202-231 sets found=true and exits when PR_HEAD_REF matches release-please--branches--*, independently of the PR author.
• The same workflow skips the AI-attribution check at lines 362-367 and makes the aggregate required gate job succeed at lines 425-427 on the same branch-name condition.
• Because full-gate-build runs only when found != 'true' (lines 236-240), the spoofed prefix bypasses the build as well as trailer verification.
• .github/workflows/gate-attestation.yml:24-40 has the same branch-shaped waiver and skips checkout and trailer verification.
• github.head_ref is the submitted PR branch name. It identifies content, not the actor or GitHub App that created the PR.

Why this matters

Any contributor able to open a pull request can select the trusted-looking prefix and obtain a green required gate without a valid Gate-Passed attestation, a CI build, or the attribution policy check. Consumers inherit the bypass from the central reusable, so one spoofable convention weakens branch protection fleet-wide.

Required mechanism

• Remove branch-name-only trust from both reusable workflows.
• Authenticate automation from a non-spoofable identity/provenance signal: the PR author's verified GitHub App/bot identity, or an explicitly verified workflow/App origin.
• If release-please can appear under multiple human/bot authors, make that identity ambiguity fail closed until the installation/provenance is verified; do not compensate with naming convention.
• Keep branch shape only as an additional consistency assertion after identity is trusted.
• Add adversarial workflow tests for a human/fork PR using the release-please prefix and for reruns where github.actor differs from the PR author.
• Inventory every caller and verify that a spoofed-prefix fixture fails the emitted required check before rollout is considered complete.