Ship through GitOps

Every change travels through a pull request to main. The required checks and resolved review threads protect the branch; auto-merge lands one squash commit, then the release and deployment flow begins from that reviewed tip.