Preserve the v1 authority and local-tool test job alongside the offline Gitea verification job.
Keep the protected gate pull-request-only, require both verification paths, pin every checkout action, and advance Rune to v0.45.0.
Track branch policy, labels, milestones, and wiki content as declarative state with a read-only-by-default provisioner.
Harden off-disk backup publication and add a rootless, networkless restore drill that validates SQLite, application data, and database-declared bare repositories.
Run offline contracts in CI, pin audited dependencies, document operations, and bump Rune to 0.43.0.
Nick