ci/woodpecker/pr/ci Pipeline was successful
verify-sanitized denylist: an operator-identity token in a ci-queue-wait comment (spec finding references genericized - the framework-PR firewall applies to shipped files). check-tools-index: repo-decl.sh shipped means documented in the resident index in the SAME commit, and executable. Full sanitization CI step replayed green locally (verify-sanitized, resident budget x2, enumeration guard, tools index x2).