Separate people, Git transport, and machine access

Access	Current contract or migration requirement
People	Verified allowed-domain OIDC sign-in, mandatory TOTP, explicit repository grants
Git transport	HTTPS; the deployment template disables SSH
SSH certificates	Prove issuance, expiry, revocation, principal mapping and CA rotation before enabling
Workflow identity	Add Forgejo Actions OIDC trust; Navigator's existing CI exchange trusts GitHub
Repository automation	Restrict identity and API scope to its repositories and permitted operations
Policy administration	Separate from the credentials available to untrusted PR jobs

Forgejo's reserved bootstrap administrator holds the first administrator seat; its random password is discarded and password sign-in is disabled. Operators use Forgejo's administrator CLI rather than sharing that password.