[andregoepel]

Core preparation still recognizes the completed no-upload test namespace. This change replaces it with the production v* trigger and strict vX.Y.Z event validation, updates the exact workflow SHA-256 in the publication policy, and extends the existing offline fixtures to cover both consumers and rejection of test/malformed tags. It also records the completed control migration and marks the old tagged test runbook as historical.

Preparation remains behind a literal-false job guard; the real publisher and every other Action are unchanged. Merging this PR does not enable preparation or publication. No release tag, policy, environment, credential, central Sonar setting or other repository is changed by this PR. Refs #29; keep the issue open for separately reviewed activation and the first release.

Validation:

• Release build: zero warnings/errors; 8/8 Core tests; no known direct/transitive vulnerabilities.
• 71 offline workflow scenarios passed (49 event/credential cases and 11 cases for each outcome recorder), executing actual Bash/jq blocks without network or publication credentials.
• CSharpier, actionlint, Bash syntax, exact policy hash and allowed-file checks passed.
• Local branch Sonar: Quality Gate OK, 100% coverage, 8 tests, no findings/hotspots. Temporary local credentials were removed and the prototype returned to its stopped state.
• Current main 3e18daa24f74ab439e17ff5278eaf7a500a5d4a4: CI 40091833784 and Sonar 40091864676 passed; live task/gate/baseline and all 27 frozen profiles rechecked unchanged. Central Sonar is main-only; this is not a central PR analysis or fresh release authorization.
• Hosted PR CI 40096044436, attempt 1 passed for exact commit d27c3ce8aac655054084942b6135cedfd4e0881d: restore, formatting, build, tests and vulnerability scan all succeeded. No separate E2E workflow exists for Core.