[tony]

Pin only the shared port builder and publisher to a914a82442dbd1be9d7b799d3019db203474ade3 from cfa8a14960f4b68c182c687672086f19840b1fc9. All other workflow bytes, library contents, triggers, permissions and language/source/version inputs remain unchanged.

• Read the product status bars a reader has dismissed in the page's head, with the theme settings every page applies before it paints, and hide a dismissed bar with one stylesheet rule per status, so a dismissed bar is never drawn (ThemeScript.astro, global.css)
• Draw the icon of a link that leaves the site in the first paint: the build writes the external-link marker into the HTML of every page, and of the native reference pages, so the icon no longer appears after the page loads and shifts the text after it (external-links.ts, mark-external-links.mjs, build-site.sh)
• Show the concept status of the Workspace Manager and of the MCP server as a dismissible bar under the page header, on every Workspace Manager and MCP page, where each page opened with it as an admonition inside the article: dismissing a bar hides that note on every page that carries it, a reader without scripts keeps it, and a page's Markdown twin leads with the same sentence (ProductNotice.astro, DocsLayout.astro, BaseLayout.astro, markdown-twins.ts)
• Put the install guidance for the workspace command, published to a registry or built from source, in the Install section of the Workspace Manager overview beside the install picker, where it was a paragraph of the status admonition (DocPage.astro, ports.ts)
• Show "No matching page" with a link to the language home, in the language picker of an MCP or Workspace Manager overview, for a port that publishes no such product, where the row linked to a page that said the product was not published (ports.ts, docs-paths.ts)
• Play Clojure's quickstart in the Core player on the Clojure landing page and on its Core page, a recorded run of the program call by call, where the program was shown without a run beside it; Clojure's own syntax (a semicolon comment, a backslash character) finds each call in it (core-statement.ts, core-player.ts)
• Link the Server, Session, Window and Pane reference pages to Haskell's counterpart, in the language picker and in the list of the same concept in other ports, and the Server page to Common Lisp's client (concepts.ts)

A bar hidden only after the page loaded would flash on every page a reader had already dismissed it on. A link to another site grew its icon after the page had loaded and pushed the text after it along. Every Workspace Manager and MCP page opened with an admonition that a reader could not close, the same sentence on every page of the product. How to obtain the workspace command sat in the status admonition, apart from the install picker it belongs beside. The language picker of an MCP or Workspace Manager overview offered the page of a port that has no such product. Clojure's landing page and Core page showed the quickstart program without a run beside it, where Java's, Kotlin's and Scala's pages each played one. A reader on a Server, Session, Window or Pane page could not jump to the same concept in Haskell, and the Server page had no link to Common Lisp's.

The exact required CI and root merge receipts of the shared checkpoint must be verified before this operator runs. This PR does not claim an owner build or publication pass. Root reviews this exact caller diff, actual repository-required checks and reviews before merge; optional native estate checks are not a new universal gate.

Execution route: controlled_real_pin_merge_push. Root separately schedules reviewed merges and exact source requests from the actual workflow state. If the current active workflow already publishes the intended source on merge, retain that actual event and do not issue a duplicate request. Future source/native/run identities will be bound to actual events.