A PR never got a CI run: the workflow triggered only on push to main
and on tags, so the risk/medium+ PR lane merged on local task check
alone (PR #66). pull_request now runs Lint/Test/Vet on the PR head;
build is gated to push and deploy already was, so a PR builds no
image, writes nothing to infra and sees no secrets.
Closes#68
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>