promote: the packet population belongs in the packet's own case arm

[DmitriyG228]

What broke

promote on run 34125041776 did its whole job and then failed:

✓ exact manifest alias vexaai/v012-admin-api:v012 = sha256:4c702354…
… all eleven, each read back and confirmed …
· :latest untouched (promote_latest not requested)
registry-candidate-validate [identity]: candidate population mismatch (expected 10 top descriptors, actual 11)
exit code 4

:v012 moved to all eleven witnessed digests and every one was read back correct. The failure is the audit after the move.

Cause

The promote job keeps its own per-version stable-promotion table, and EXPECTED_MAP_SHA256 lives inside its case arms. --expected-top-descriptors and --expected-platform-identities were literals outside that case — so they described whichever release was current when they were written.

v0.12.27 adds an eleventh image (vexaai/v012-flows). releases/v0.12.27/candidate-images.json holds 11 top descriptors and 21 platform identities; the literals still said 10 and 19. The resolve job's table already carried the correct pair — only promote's copy was stale, which is why image-identity passed and promote did not.

The change

The counts move into the same arm as the sha they describe: 10/19 for v0.12.18 and v0.12.23, 11/21 for v0.12.27. Values read off the packet, not guessed.

The assertion keeps its force. The expected pair still comes from the reviewed table rather than from the file under test, so a truncated map still fails — deriving the counts from the candidate map would have made the check assert nothing.

Why it went unnoticed

Nothing had taken the promote path since 0.12.23. This is the fourth defect on it found today; the previous three were the candidate-version rule (#1651), the stable-promotion map arm (#1654) and the absent negative control (#1656). All four are the same shape: a per-release fact held somewhere that does not move per release.

Verification

• releases/v0.12.27/candidate-images.json parsed: 11 top descriptors, 21 platform identities.
• Workflow YAML parses; 13 jobs, unchanged.
• No change to the alias, the readback, the :latest guard, or the Environment gate.

v0.12.27 is already released and :v012 is already on the witnessed digests — this run's alias succeeded. This fix is so the next release's promote does not red on a correct promotion.

[github-actions]

🃏 Merge card — #1662

check		what it needs
Value	❌	missing state: value-signed (the value sign-off)
Diff	✅	maintainer self-review — @DmitriyG228 holds the commit bit (no separate non-author review required)

Not mergeable yet — every row above must be accepted before merge (choke point 1). Fill in what's ❌ above, then this clears automatically.

_{How a PR reaches merge: the merge bar.}