Production-harden GitHub status publication and branch-protection cut-over

[hyperpolymath]

Outcome

Harden GitHub status publication into a production-quality, auditable integration.

Scope

• Select and document the supported credential model: fine-grained token and/or dedicated GitHub App.
• Minimise repository permissions and isolate signing keys from GitHub credentials.
• Bind status publication to repository, immutable SHA, check context, envelope digest, signer, and verified result.
• Provide a durable, access-controlled target URL for verification evidence without leaking logs or secrets.
• Handle force-pushes, cancelled runs, stale results, retries, rate limits, revoked credentials, and fork PRs.
• Add a branch-protection migration guide and a safe advisory-to-required cut-over procedure.

Acceptance criteria

• A signed pass can green only its bound repository/SHA/context.
• Replayed, stale, cross-repository, or tampered results cannot satisfy a required gate.
• Rate-limit and transient-post failures retry without rerunning successful checks.
• Security tests exercise token loss, signer rotation, and malicious target URLs.