[ymote]

The publisher workflow still pinned a pre-merge App Hub head, while the matching host now uses merged Hub 386359153ed6377b5f047bd9ed2767a6a2ac2bc7. Pin generated publishing workflows to that reviewed revision and synchronize octo new with its reserved updater namespace, so scaffolding refuses an id the gate would reject before creating project files.

The pin retains WASI socket admission and includes the merged updater identity and offline store-test fixes. English/Chinese publishing and Rust guides name the same revision. Existing generated app workflows still need an explicit reviewed publish-github --replace to adopt the new pin; no app bundles or workflows are rewritten here. Socket-host documentation keeps its unreleased boundary; this PR does not publish RC6.

Validation:

• Exact clean pinned Hub was rebuilt; all 14 publisher checks passed using real SDK HTTP, socket, host-service and filesystem components. This verifies structural admission/preparation and missing ABI/proof/malformed-component refusal, not publication or runtime execution.
• All 48 Python tooling tests passed with the pinned Hub checkout available, including contract reserved-name parity and real scaffold/build checks.
• Reserved-name parity reproduced a failure before the updater correction; parity and no-partial-project checks passed afterward.
• Markdown links: 0 broken, 0 pending. Diff checks passed.