ci: unbreak main, gate pull requests, and close the factory drift - #42

Open

castrojo wants to merge 13 commits into

mainfrom

ci/audit-hardening

Commits on Aug 1, 2026

fix(ci): unbreak the lab-runner and aarch64 VM build legs

castrojo
and
Copilot
committed
feat(ci): declare per-image path ownership and a changed-targets recipe

castrojo
and
Copilot
committed
feat(ci): build and verify affected targets on every pull request

castrojo
and
Copilot
committed
fix(ci): give automated dependency PRs real checks

castrojo
and
Copilot
committed
feat(ci): adopt the factory's security and hygiene workflows

castrojo
and
Copilot
committed
docs(ci-tooling): document the gate, the token rule, and the scan shape

castrojo
and
Copilot
committed
fix(ci): pin label enforcement to the only ref that has the workflow

castrojo
and
Copilot
committed
ci: drop the label-enforcement caller until upstream is usable

castrojo
and
Copilot
committed