feat(release): publish verified source tags

tools/release/govoplan_release/publisher.py

@@ -15,6 +15,7 @@ from .catalog import canonical_hash
 from .model import CatalogPublishResult, CatalogPublishStep
 from .module_directory import write_module_directory
 from .selective_catalog import trusted_keys_from_keyring
+from .source_provenance import catalog_source_selection, source_tag_provenance_issues
 from .version_alignment import candidate_catalog_version_issues
 from .workspace import DEFAULT_WORKSPACE_ROOT, resolve_workspace_root, website_root
 
@@ -31,6 +32,7 @@ def publish_catalog_candidate(
     tag: bool = False,
     push: bool = False,
     remote: str = "origin",
+    source_remote: str = "origin",
     branch: str | None = None,
     npm: str = "npm",
     tag_name: str | None = None,
@@ -79,6 +81,23 @@ def publish_catalog_candidate(
             f"expected {issue.expected!r} ({issue.message})"
             for issue in version_issues
         )
+        source_selection = catalog_source_selection(candidate_payload)
+        blockers.extend(
+            f"source provenance: {issue.describe()}"
+            for issue in source_selection.issues
+        )
+        source_issues = source_tag_provenance_issues(
+            repo_versions=source_selection.all_versions,
+            workspace=workspace,
+            remote=source_remote,
+            require_head_repos=source_selection.selected_versions,
+            expected_commits=source_selection.selected_commits,
+            expected_tag_objects=source_selection.selected_tag_objects,
+        )
+        blockers.extend(
+            f"source provenance: {issue.describe()}"
+            for issue in source_issues
+        )
         candidate_keys = trusted_keys_from_keyring(keyring_payload if isinstance(keyring_payload, dict) else {})
         target_keyring_payload = read_json(target_keyring) if target_keyring.exists() else None
         publication_trust = trusted_keys_from_keyring(