Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Security review: changes are CI-tooling only. No new secret handling; the import fallback reads a same-repo sibling file by file-relative path (no traversal/injection). The 403 soft-skip narrows to 401/403 only and degrades the ADVISORY reconcile, not the enforcing pin-drift check, so SSOT enforcement is preserved. Approve.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: one-line .runtime-version pin bump to the published SSOT tag. CI green.
Reviewed: SSOT allowlist add of qa-review/security-review/reserved-path-review + bp-required:pending #3141 directives. CI/all-required (the BP gate) green; the lint-continue-on-error-tracking red is pre-existing (stale mc#3140 ref in prune-stale-e2e-dns, not this diff). Fail-closed verified (target-variant starts red, flips on genuine non-author APPROVE; no deadlock). Ordering correct (allowlist merges before BP flip). LGTM — and we should dogfood it: get genuine pool review before merge.
Reviewed: cosmetic finisher to the exact-host CSP tightening — removes the now-dead *.r2.cloudflarestorage.com wildcard from the canvas img-src literal (the ENFORCED exact-host pin already shipped via merged #890 on the Go side; browser enforces the intersection). img-src only; connect-src untouched. LGTM.
Reviewed: additive post-push ensure-ecr-lifecycle step, fail-soft (never breaks publish), canonical policy SSOT, lints pass. Durable prod-ECR cost guard. LGTM.