The commit that added the absolute buildDir and the one that removes it both carry it in their diffs, so the history scan flags them forever.
Allowlisting is the only exit that does not rewrite history two forges already hold.
Tags now cross only after the release gates. Public assets are read back anonymously and hashed; the Rust Action pin now names its advertised stable commit.