fix(release): validate frozen targets with current workflows (#108189)

* fix(release): support frozen validation targets

* fix(release): filter frozen-target upgrade scenarios

.github/workflows/ci.yml

@@ -1705,7 +1705,25 @@ jobs:
           OPENCLAW_VITEST_NO_OUTPUT_RETRY: "1"
           OPENCLAW_NODE_TEST_PLAN_CONCURRENCY: ${{ matrix.plan_concurrency }}
         shell: bash
-        run: node scripts/ci-run-node-test-shard.mjs
+        run: |
+          set -euo pipefail
+          runner="scripts/ci-run-node-test-shard.mjs"
+          if [[ ! -f "$runner" ]]; then
+            # Frozen release targets can predate the workflow-owned shard runner.
+            # Load only that runner from the exact trusted workflow commit while
+            # keeping its child tests rooted in the checked-out candidate.
+            harness_root="${RUNNER_TEMP}/openclaw-ci-shard-runner"
+            git fetch --no-tags --depth=1 origin "$GITHUB_SHA"
+            for file in \
+              scripts/ci-run-node-test-shard.mjs \
+              scripts/lib/direct-run.mjs \
+              scripts/lib/local-heavy-check-runtime.mjs; do
+              mkdir -p "${harness_root}/$(dirname "$file")"
+              git show "${GITHUB_SHA}:${file}" > "${harness_root}/${file}"
+            done
+            runner="${harness_root}/${runner}"
+          fi
+          node "$runner"
 
   # Types, lint, and format check shards.
   check-shard:

.github/workflows/npm-telegram-beta-e2e.yml

@@ -345,18 +345,33 @@ jobs:
             --arg attempt "$ARTIFACT_RUN_ATTEMPT" \
             --arg run_id "$ARTIFACT_RUN_ID" \
             '(.id | tostring) == $run_id and
-             (.run_attempt | tostring) == $attempt and
-             .status == "completed" and
-             .conclusion == "success"' \
+             (.run_attempt | tostring) == $attempt' \
             <<< "$attempt_json" >/dev/null || {
             echo "Package Telegram artifact producer run attempt does not match the requested tuple." >&2
             exit 1
           }
           attempt_started_at="$(jq -er '.run_started_at | fromdateiso8601' <<< "$attempt_json")"
-          attempt_completed_at="$(jq -er '.updated_at | fromdateiso8601' <<< "$attempt_json")"
-          if (( artifact_created_at <= attempt_started_at || artifact_created_at > attempt_completed_at )); then
-            echo "Package Telegram artifact creation time is outside the declared producer run attempt." >&2
-            exit 1
+          if [[ "$ARTIFACT_RUN_ID" == "$GITHUB_RUN_ID" ]]; then
+            jq -e '.status == "in_progress" and .conclusion == null' \
+              <<< "$attempt_json" >/dev/null || {
+              echo "Current-run Package Telegram artifact is not from the active workflow attempt." >&2
+              exit 1
+            }
+            if (( artifact_created_at <= attempt_started_at )); then
+              echo "Package Telegram artifact predates the active producer run attempt." >&2
+              exit 1
+            fi
+          else
+            jq -e '.status == "completed" and .conclusion == "success"' \
+              <<< "$attempt_json" >/dev/null || {
+              echo "Completed Package Telegram artifact producer run attempt was not successful." >&2
+              exit 1
+            }
+            attempt_completed_at="$(jq -er '.updated_at | fromdateiso8601' <<< "$attempt_json")"
+            if (( artifact_created_at <= attempt_started_at || artifact_created_at > attempt_completed_at )); then
+              echo "Package Telegram artifact creation time is outside the declared producer run attempt." >&2
+              exit 1
+            fi
           fi
 
       - name: Download package-under-test artifact

.github/workflows/openclaw-live-and-e2e-checks-reusable.yml

@@ -389,6 +389,7 @@ env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
   NODE_VERSION: "24.15.0"
   OPENCLAW_DOCKER_E2E_ALLOW_UNRELEASED_CHANGELOG: ${{ inputs.allow_unreleased_changelog }}
+  OPENCLAW_UPGRADE_SURVIVOR_TARGET_ROOT: ${{ github.workspace }}
 
 jobs:
   validate_selected_ref: