Functionality looks correct and the fix is proportionate. A few things to clean up before merge.

1. Docstring style doesn't match the repo convention

Existing docstrings in helpers.py (and the rest of the CLI modules) are terse, plain-text, no backticks, typically 1-2 sentences. Examples from the same file:

• """Apply Click decorators in the declared display order."""
• """Format raw token amount (9-decimal) as human-readable ALPHA string."""
• """Wrap status text with the appropriate Rich color tag."""

The new docstrings in this PR use RST-style double-backticks (``validate_repository``, ``click.BadParameter``) and multi-paragraph design-justification prose. The CLI modules have zero prior uses of double-backticks, so this PR would be introducing a new style into files that have never had it.

Please rewrite the new docstrings to match. For _raise_github_verification_required, something like:

def _raise_github_verification_required(...) -> None:
    \"\"\"Raise BadParameter when a GitHub existence probe could not complete.

    Used by the strict variants of validate_repository and validate_github_issue
    so mutation commands never fall through to on-chain writes on transient failures.
    \"\"\"

Same for the updated docstrings on validate_repository and validate_github_issue — keep them terse, drop the backticks, drop the multi-paragraph rationale.

2. Error messages leak Python exception class names to end users

The current format produces:

• Could not verify issue #42 in owner/repo on GitHub (status 503). ... (readable)
• Could not verify issue #42 in owner/repo on GitHub (ConnectionError). ... (leaks Python class name)
• Could not verify issue #42 in owner/repo on GitHub (Timeout). ... (leaks Python class name)

ConnectionError / Timeout are Python class names, not meaningful to CLI users. Map exception paths to human-readable terms:

# Currently:
_raise_github_verification_required(..., type(exc).__name__, param_hint='--issue')

# Better:
_raise_github_verification_required(..., 'network error', param_hint='--issue')

If you want to distinguish timeout from connection error, map them explicitly:

detail = 'timeout' if isinstance(exc, requests.Timeout) else 'network error'

3. Optional — latent parameter combo

validate_repository accepts both verify_exists=True (default) and require_verified_exists=False (default). If a future caller passes verify_exists=False, require_verified_exists=True, the verification block is skipped entirely and require_verified_exists silently has no effect. Not an issue today since issue_register uses the right combination, but worth a guard:

if require_verified_exists and not verify_exists:
    raise ValueError('require_verified_exists requires verify_exists=True')

Optional, take it or leave it depending on your defensive-coding taste.

Otherwise:

The bug is real and well-documented (bittoby's issue #712 was excellent), the fix is narrow (opt-in flag, default preserves all existing callers), the tests are unusually good (back-compat lock-in, 404 still wins, sentinel tests that contract_instance.exec is never reached). Once the docstring style and the exception-name leak are fixed, this is ready to merge.