Codex review round three: a prior green run may have executed with different lane definitions; the resolver now compares the candidate run head SHA's .github/workflows tree against the current workflow ref before accepting its manifest.