Function detect_distribution_surface 

pub fn detect_distribution_surface(
    repo_root: &Path,
    fs: &dyn Fs,
) -> DistributionSurface

Detect cargo-dist configuration and tag-triggered GitHub workflows through the injected filesystem port. The trigger scanner intentionally recognizes only the ordinary nested on: push: tags: shape: missing an exotic YAML spelling is safe, while treating an unrelated tags: key as release infrastructure is not.

Cargo publication evidence follows repository-local reusable workflow calls, so a conventional tag workflow delegating to on: workflow_call is not misreported as missing. This remains evidence for a plan-time warning, not a hard validator: shell scripts and remote reusable workflows cannot be proved by a bounded tree scan.