EIP-712 the human publisher signs to release their own escrow

The same LifecycleOrder typed data as GET /api/v1/escrow/task/{task_id}/lifecycle-challenge, reachable with the publisher's Supabase session instead of an ERC-8128 signature.

It exists because the two planes authenticate differently and a human publisher has no wallet-signed HTTP identity: the escrow-plane route reads verify_agent_auth_read, so a browser sending its Supabase JWT resolves to the anonymous sentinel and gets 403 — the publisher could not read the order over their own escrow. The typed data, the escrow lookup and the ownership rules are the SAME functions; only the door is different.

Read-only: it authorizes nothing and moves nothing. Sign it with the wallet that funded the escrow and send it back as lifecycle_order in the approve body.