[drudge]

Summary

• add required-quality GitHub Actions coverage for formatting, module integrity, generated code, tests, vet, the race detector, and reachable vulnerability scanning
• add native release and cluster smoke checks for pull requests, with multi-architecture archive and container smoke checks after merges to main or manual dispatches
• add weekly grouped Dependabot updates for Go modules and GitHub Actions while leaving major upgrades isolated for review
• pin third-party Actions to immutable release commits and manage Mage, templ, and govulncheck through Go tool directives so Dependabot can update them
• preserve one-shot completion notices when very fast backup or restore jobs finish around the initial HTTP response
• update the stale Mage version in the release documentation

Security and reliability

• workflows use read-only repository permissions
• Action dependencies are pinned to full commit SHAs
• redundant runs are cancelled per branch
• all jobs have explicit timeouts
• container builds are never published by CI

Verification

• actionlint v1.7.12
• Dependabot YAML parse and ecosystem checks
• formatting check
• go mod verify
• idempotent go mod tidy
• go tool mage verify
• go tool mage race
• affected backup and restore tests repeated 100 times, plus 20 iterations under the race detector
• go tool govulncheck ./...
• go tool mage releaseCheck with GoReleaser v2.18.0
• go tool mage releaseSmoke
• go tool mage dockerSmoke