Read optional intake precautions at their expandable report fields, bind OpenShift Secret tests to the validated private file, and target helper workflow negative controls by step. Preserve the prepared GNU timeout in the private teardown probe on macOS and keep the actual security migration boundaries mandatory. Production guidance, installer behaviour and platform coverage are unchanged.
Contract-Neutral: Fixture-only integration repair; no product, installer, workflow, deployment or safety contract delta.
Change-source: pulse-maintainer
The native workflow did not admit helper/protocol/filesystem/signature-only edits and omitted their suites. Extend its existing Linux jobs with bounded uncached race coverage and an actual helper build, preserving ordinary-user execution and all installed/PVE acceptance boundaries. Regression controls reject missing triggers, platforms, packages and hidden failure.
Contract-Neutral: Native source-verification coverage only; installed helper authority, signed migration, isolation and guest-recovery contracts are unchanged.
Change-source: pulse-maintainer
pulse-triage[bot]