fix(release): preserve current recovery contracts

.github/workflows/plugin-npm-release.yml

@@ -1361,7 +1361,7 @@ jobs:
             scripts/lib/tsx-cli-shim.mjs \
             .publication-target/scripts/lib/tsx-cli-shim.mjs
 
-      - name: Setup OIDC publication target
+      - name: Setup trusted OIDC packaging dependencies
         if: steps.publication_evidence.outputs.publish_route == 'npm-oidc'
         uses: ./.github/actions/setup-node-env
         with:

docs/reference/RELEASING.md

@@ -561,24 +561,6 @@ gh workflow run openclaw-release-publish.yml \
 
 Include `plugin_sdk_api_acknowledgement` only when the npm preflight's Plugin SDK API report contains changes.
 
-If a beta package is already published but its container images are missing,
-do not rerun npm or plugin publication. Reuse the immutable beta tag plus its
-successful npm preflight and Full Release Validation evidence through the
-Docker-only recovery path. The workflow rechecks the exact npm version, the
-`beta` selector, and the published tarball digest before building containers:
-
-```bash
-gh workflow run openclaw-release-publish.yml \
-  --ref main \
-  -f tag=vYYYY.M.PATCH-beta.N \
-  -f preflight_run_id=<successful-openclaw-npm-preflight-run-id> \
-  -f full_release_validation_run_id=<successful-full-release-validation-run-id> \
-  -f full_release_validation_run_attempt=<successful-full-release-validation-run-attempt> \
-  -f npm_dist_tag=beta \
-  -f publish_openclaw_npm=false \
-  -f publish_docker_only=true
-```
-
 Stable publish to the default beta dist-tag:
 
 ```bash

test/scripts/package-acceptance-workflow.test.ts

@@ -1524,7 +1524,7 @@ describe("package acceptance workflow", () => {
     expect(verifyStep.run).not.toContain("npm view openclaw@extended-stable version");
   });
 
-  it("accepts only exact protected SHA-pinned release publish tags", () => {
+  it("accepts only main-reachable protected SHA-pinned release publish tags", () => {
     const workflowSha = "a".repeat(40);
     const binDir = tempDirs.make("release-publish-gh-");
     const ghPath = `${binDir}/gh`;