[cpp-RCP-14] Release workflow auto-commits regenerated safety artifacts to main with no review #82

Location: .github/workflows/release.yml — regenerate-safety-artifacts job (~lines 59-153), specifically the "Commit regenerated artifacts" step.

Finding: On every v* tag push, this workflow regenerates a full set of safety/certification artifacts (tara.json/tara.md, fmea.*, safety-case.*, sbom.json, gap reports, coverage report, etc.) using tooling checked out unpinned (see the related unpinned-cpp-FuSa issue, #59), and then commits and pushes them straight to main as github-actions[bot] with [skip ci], bypassing normal PR review. This is the actual mechanism that keeps the mismatched/boilerplate tara.json (see the related findings about it targeting the wrong subject and citing dependencies that don't exist in this repo) continuously regenerated and re-committed to the protected branch without a human ever reviewing the diff.

Recommendation: Generate release-time safety evidence as build/release artifacts (uploaded to the release, not committed to source), or, if committing regenerated evidence to main is intentional, route it through a PR that requires review rather than a direct bot push with [skip ci]. At minimum, stop force-overwriting the hand-authored TARA-ANALYSIS.md-style documents with tool-generated boilerplate on every tag.

Verification: Independently re-read .github/workflows/release.yml against current HEAD (commit 4b9449a, 2026-07-29). Confirmed the job builds cpp-FuSa from an unpinned clone, regenerates the listed artifacts, and on any diff runs git commit + git push origin HEAD:refs/heads/main directly, with no PR/review step in between.

Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.