chore(ci): regenerate velnor-workflow tree at schema 2 (wave pin 4dec6b9e)

.github-gen/velnor-workflow.toml

@@ -1,24 +1,66 @@
-schema = 1
+schema = 2
 
 [generator]
 repository = "tailrocks/holla-apt"
-revision = "4fa7a3a85f141a6bb95bc9bdf0eef9e3ddde165d"
+# D19 pin: the velnor-workflow BUILD commit whose product rendered this tree.
+revision = "4dec6b9ec28b0d51cb370fd8f5d5401c6186adf0"
+
+[workflow]
+providers = ["github-hosted"]
+automatic_providers = ["github-hosted"]
+default_branch = "main"
+profile = "apt-repository"
+
+[workflow.selectors.github-hosted]
+runs_on = ["ubuntu-24.04"]
+
 [policy]
-ruleset_required_status_checks = ["ci-required"]
+ruleset_required_status_checks = ["ci-required", "Policy"]
 ruleset_external_status_checks = ["DCO"]
 
+# [renovate] DEFERRED (W4 escalation): s2 `validate_renovate`
+# (s2/config/mod.rs) requires the velnor provider +
+# [workflow.selectors.velnor], but `enforce_visibility_policy` (s2/mod.rs)
+# requires public repos to be exactly [github-hosted] and rejects a velnor
+# selector — so [renovate] is unsatisfiable on public repos at this pin.
+# The renderer itself is provider-agnostic (`control_plane_runner`), so the
+# fix is validation-only (generator side). Re-add with [[declare]]
+# renovate + renovate-validate rows once the generator admits a hosted
+# writer for public repos.
+# [renovate]
+# enabled = true
+# reason = "Scheduled dependency PRs per renovate.json. ..."
 
-[workflow]
-profile = "apt-repository"
-runners = "both"
-automatic = "both"
-github_runner = "ubuntu-24.04"
-velnor_labels = ["self-hosted", "velnor-target-mvp"]
-default_branch = "main"
-files = ["ci-unit-docs.yml"]
+[release]
+enabled = true
+reason = "APT feed publisher: verify-before-mutation feed workflow for the holla Debian repository."
+kind = "apt"
+package = "holla"
+binary = "holla"
+source_repository = "tailrocks/holla"
+consumer_repository = "tailrocks/holla-apt"
+manifest_schema = "velnor.package-release.v1"
+signer_fingerprint = "925B7B4B807283B2391DEF2DE5BC87724E0F3E0A"
+passphrase_secret = "APT_GPG_PASSPHRASE"
+signing_key_secret = "APT_GPG_PRIVATE_KEY"
+keyring_path = "holla.gpg"
+apt_origin = "Holla"
+apt_feed_url = "https://holla-apt.tailrocks.com"
+description = "apt repository for holla - adaptive dev environment CLI"
+retention = 1
+
+[[declare]]
+primitive = "release"
+file = "release.yml"
 
 [[units]]
 id = "docs"
 label = "Documentation"
 kind = "docs"
 root = "."
+# s2 runtime requires every CI unit to declare commands; the s1 tree ran
+# none. `check` is the repo's human aggregate (actionlint + shellcheck +
+# package-update-test, whose publication assertions now target the generated
+# release.yml). Tools below must stay lock-pinned (see velnor-apt).
+ci_tasks = ["check"]
+mise_tools = ["actionlint", "jq", "ripgrep", "shellcheck"]

.github-gen/visibility.toml

@@ -0,0 +1,2 @@
+repository = "tailrocks/holla-apt"
+visibility = "public"

.github/AGENTS.md

@@ -0,0 +1,5 @@
+# Generated files
+
+Everything under `.github` is generated by [velnor-workflow](https://github.com/tailrocks/velnor/tree/main/crates/velnor-workflow).
+
+Never hand-edit this directory. Changes to generated behavior require a Velnor PR: first research, analyze, and independently verify a generic solution, never a repository-specific workaround. Keep generation inputs outside `.github`, then regenerate. Root `AGENTS.md` rules still apply.

.github/CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

.github/actionlint.yaml

@@ -4,6 +4,4 @@
 
 self-hosted-runner:
   labels:
-    - self-hosted
     - ubuntu-24.04
-    - velnor-target-mvp

.github/ci/.github-actions-generator-state

@@ -1,11 +1,19 @@
 # Generated ownership state; do not edit.
 schema = 2
 [inputs]
-config	ce9ef35ac6d76a3d
-scan	a263362d4f301684
-generator	54
+config	7220ca5849f32df4
+scan	91be9c9948367bd2
+generator	69
 [outputs]
-.github/actionlint.yaml	ec35f48ae7e90e0e
-.github/ci/project.toml	a0a5c1624ba0e68f
-.github/workflows/ci-unit-docs.yml	a15245ae1f15dd70
+.github/AGENTS.md	02ebb7198c435e9b
+.github/actionlint.yaml	c642e98fce5b1906
+.github/ci/project.toml	0a8b113b173a96e1
+.github/workflows/ci-main.yml	1405cceb65d68ebf
+.github/workflows/ci-policy.yml	6ed3b0156220a772
+.github/workflows/ci-pr.yml	3a5a80f7f905ef02
+.github/workflows/ci-unit-docs.yml	295416c0e0720839
+.github/workflows/maintenance.yml	40515e95a46d5259
+.github/workflows/nightly.yml	0659fbb3d6af2359
+.github/workflows/release.yml	7eb1a5edd73ae668
 config/fleet/velnor-host.env	d14b419216449423
+.github/CLAUDE.md	78a740c6ccf6937a

.github/ci/project.toml

@@ -1,32 +1,48 @@
 # Generated by velnor-workflow. Regenerate; do not hand-edit.
-schema = 2
+schema = 3
 repository = "tailrocks/holla-apt"
 profile = "apt-repository"
 verified = true
 default_branch = "main"
-runners = "both"
+providers = ["github-hosted"]
+automatic_providers = ["github-hosted"]
+default_dispatch_providers = ["github-hosted"]
 
 [analysis]
 method = "static-filesystem-and-manifest-inspection"
 detected = ["renovate-configuration"]
 limitations = ["Project code, build scripts, task runners, and commands are never executed during analysis.", "Release, signing, registry, deployment, branch-protection, and runner-capability contracts remain explicit manual inputs.", "Renovate credentials, runner placement, and write permissions cannot be inferred from repository files."]
 
 [workflow]
-github_runner = "ubuntu-24.04"
-velnor_labels = ["self-hosted", "velnor-target-mvp"]
-files = ["ci-unit-docs.yml"]
+files = ["ci-main.yml", "ci-policy.yml", "ci-pr.yml", "ci-unit-docs.yml", "maintenance.yml", "nightly.yml", "release.yml"]
 
 [release]
-enabled = false
-reason = "Release is fail-closed. Enable only after declaring immutable artifact, registry, provenance, and tag-protection policy."
+enabled = true
+reason = "APT feed publisher: verify-before-mutation feed workflow for the holla Debian repository."
+kind = "apt"
+package = "holla"
+packages = []
+binary = "holla"
+targets = []
+source_repository = "tailrocks/holla"
+consumer_repository = "tailrocks/holla-apt"
+description = "apt repository for holla - adaptive dev environment CLI"
 
 [[unit]]
 id = "docs"
 label = "Documentation"
 kind = "docs"
 root = "."
 watch = []
-github_pr_commands = []
-github_full_commands = []
-velnor_pr_commands = []
-velnor_full_commands = []
+pr_commands = ["mise run check"]
+full_commands = ["mise run check"]
+platform = "linux-x64"
+trust = "untrusted-ok"
+[unit.capabilities]
+docker = false
+nested_privileged_docker = false
+buildx_compose = false
+testcontainers = false
+services_with_readiness = false
+browser_binaries = false
+native_macos_arm64 = false