Block a user
docs(decisions-log): end-of-session PM handoff
feat(sec): constrain the conformance CI trigger at admission
fix(ci): CLUSTER_AVAILABLE=true would have faked a green
fix(ci): the settings token could never have been stored
feat(ci): detect Gitea settings drift
fix(gitea): admins could override the gate
docs(ci): close out the hardening; correct a claim that shipped wrong