Merge origin/main into align-wilm-main (align wilm with Cameron's latest)

Bring main's endpoint hardening, operator-report validation, launch-path
policy, and theme-variable CSS into wilm. Channel model reconciled to this
repo's shipping (stable=release tag, edge=main trunk) while keeping wilm's
remote-BuildKit publish step and GHCR pull-based launcher.

.github/workflows/publish-images.yml

@@ -8,22 +8,31 @@
 # A single image pull is one resumable HTTPS stream, far more robust through
 # the proxy than hundreds of npm requests.
 #
-# Channels map to branches:
-#   main   -> ghcr.io/<owner>/shopdb-flask:stable  (badge off)
-#   dev-be -> ghcr.io/<owner>/shopdb-flask:edge    (SHOPDB_ENV_LABEL=DEV badge)
+# Channels are mapped to how THIS repo actually ships, which is not how the
+# branch this came from ships. Upstream, main is a release branch and dev-be is
+# the trunk. Here main IS the trunk - it runs hundreds of commits past the last
+# release - and releases are tags (ADR-007). Publishing main as :stable would
+# put unreleased work behind a word that promises the opposite, to sites that
+# have no way to know:
 #
-# Each push to those branches rebuilds and republishes its channel tag, so
-# `edge` stays genuinely bleeding edge. The image is also tagged with the short
-# commit SHA for traceability and rollback.
+#   tag v*  -> ghcr.io/<owner>/shopdb-flask:stable  (badge off)  the release
+#   main    -> ghcr.io/<owner>/shopdb-flask:edge    (DEV badge)  the trunk
+#
+# The image also carries a short-SHA tag for traceability and rollback.
+#
+# Automatic publishing is OFF until someone confirms the GHCR package exists
+# under this owner and decides who may pull it. Re-enable by uncommenting the
+# push: block below; workflow_dispatch works meanwhile.
 
 name: publish-images
 
 on:
-  push:
-    branches:
-      - main
-      - dev-be
-  # Allow a manual rebuild/publish of the current branch's channel image.
+  # push:
+  #   tags:
+  #     - 'v*'
+  #   branches:
+  #     - main
+  # Manual rebuild/publish of the current ref's channel image.
   workflow_dispatch:
 
 # One in-flight publish per branch; a newer push supersedes an older one.
@@ -48,7 +57,10 @@ jobs:
         run: |
           owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
           image="ghcr.io/${owner}/shopdb-flask"
-          if [ "${{ github.ref_name }}" = "main" ]; then
+          # A tag is a release, anything else is the trunk. Deliberately not
+          # keyed on the branch name: a release here is a tag, so keying on
+          # "main" would label the trunk stable.
+          if [ "${{ github.ref_type }}" = "tag" ]; then
             channel="stable"
           else
             channel="edge"
@@ -64,18 +76,18 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Connect to a persistent, out-of-cluster BuildKit deployment instead of
-      # spinning up a builder against a local Docker daemon. The arc-runner-set
-      # pods have no Docker daemon (no /var/run/docker.sock) and cannot run a
-      # privileged DinD sidecar under cluster policy, so we point Buildx at a
-      # remote buildkitd Service. The endpoint is provided as a repo/org secret
-      # (e.g. tcp://buildkit.buildkit.svc.cluster.local:1234), so it is not
-      # hardcoded here. See deploy/ci/buildkit-remote.yaml for the deployment.
-      - name: Set up Buildx (remote BuildKit)
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver: remote
-          endpoint: ${{ secrets.BUILDKIT_ENDPOINT }}
+# Connect to a persistent, out-of-cluster BuildKit deployment instead of
+# spinning up a builder against a local Docker daemon. The arc-runner-set
+# pods have no Docker daemon (no /var/run/docker.sock) and cannot run a
+# privileged DinD sidecar under cluster policy, so we point Buildx at a
+# remote buildkitd Service. The endpoint is provided as a repo/org secret
+# (e.g. tcp://buildkit.buildkit.svc.cluster.local:1234), so it is not
+# hardcoded here. See deploy/ci/buildkit-remote.yaml for the deployment.
+- name: Set up Buildx (remote BuildKit)
+  uses: docker/setup-buildx-action@v3
+  with:
+    driver: remote
+    endpoint: ${{ secrets.BUILDKIT_ENDPOINT }}
 
       - name: Build and push channel image
         uses: docker/build-push-action@v6