Bind the workflow to one Project and one commit

Deployment Actions stays disabled until isolated, ephemeral runners and the Project workflow are proved. Port the existing gate rather than replacing its checks. Every PR update must validate the pinned manifest and run navigator project gate --ci; authorized live reads use the document-check path.

Forgejo Actions OIDC can identify a run to an external service. The migration must verify its issuer, audience, expiry, repository, workflow, event, ref and commit before issuing short-lived Navigator or cloud access. Resolve the authorized Project from the repository binding, then check the manifest agrees. Untrusted YAML cannot select another Project, deployment or artifact prefix.

PR jobs receive no publication credentials. After a governed merge, verify the merged commit and publish only that Project's allowed artifacts. Prove the same flow after credential expiry and on a denied cross-Project request.