Prevent Server releases from downgrading the embedded Workflow package

[rmcdaniel]

Problem

Server source and published Server images can resolve different embedded Workflow packages.

For Server 2.0.0-rc.30, composer.json requires durable-workflow/workflow:2.0.0-rc.31 and composer.lock binds that package to commit a4ce321a31ba5f4d9c25964cde81109bf253c5aa. The public release run selected Workflow 2.0.0-rc.13 at fc28432a82a2433959c6690505c52eabea4aca8c, and the published image labels advertise that older package.

The release workflow, Dockerfile, Compose defaults, feature/performance jobs, replay-query and Helm checks, and Composer metadata helper retain a second hand-maintained Workflow identity. Protocol compatibility selection can therefore downgrade the package embedded in the image even when the Server source requires a newer prerelease. A green release currently proves internal consistency with the stale release pin, not consistency with the Server source dependency authority.

Required outcome

• Establish one exact embedded Workflow package authority for a Server source revision. The declared Composer requirement, lockfile version and source commit, image build, release metadata, protocol catalog, runtime discovery, Docker/Compose defaults, and all qualification jobs must agree.
• Remove the stale 2.0.0-rc.13 / fc28432a82a2433959c6690505c52eabea4aca8c defaults from current Server build and qualification paths.
• Release selection must not silently choose an older merely protocol-compatible Workflow prerelease than the package locked by the Server source. Any caller-supplied package ref or commit that disagrees with the source authority must fail closed before publication.
• Keep source-admission support for an exact, landed Workflow commit whose release tag is not yet available, while requiring that qualification identity to match the Server source authority.
• Add a structural regression that changes the locked Workflow identity and proves every release/build/test consumer follows the new identity or rejects a stale override. The check must cover the Dockerfile, release workflow, PHPUnit/feature qualification, performance qualification, replay-query qualification, Helm smoke, Compose defaults, metadata generation, image labels, and protocol-catalog evidence.
• Publish the next Server release candidate without moving or replacing the immutable 2.0.0-rc.30 tag.
• Completion requires public release evidence showing the next Server image embeds and advertises the exact Workflow version and commit required by that Server source.