A PR never got a CI run: the workflow triggered only on push to main and on tags, so the risk/medium+ PR lane merged on local task check alone (PR #66). pull_request now runs Lint/Test/Vet on the PR head; build is gated to push and deploy already was, so a PR builds no image, writes nothing to infra and sees no secrets. Closes #68 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>