source-control: inline promotion evidence loses a gate failure when its workflow run is deleted #7518

Refs: #4588, #7516

File mode's publish refuses to drop an earlier event (superset check in publish-promotion-evidence.mjs publish()). Inline mode rebuilds events from GitHub on every call, and a red post-merge run is the only source of its gate-failure. An identity with actions:write (the lane identity dispatches pr-require-checks.yml) can DELETE /actions/runs/{id}, and the demoted cell then reads promoted again. Needs a misbehaving or prompt-injected holder of that identity.

#7516 records the limit in reference/promotion-evidence-resolution.md, "Inline mode". Decision needed before pr-merge adopts inline mode: append events to storage the lane cannot write and fail closed when a recorded event disappears, or accept the gap and state that actions:write holders are trusted.

Found by the ready-for-review security review of #7516.