Adopt main-only PR workflow and integrate reviewed dependency updates

[ak5]

Summary

Make main Charon's only long-lived, protected default branch. Feature, dependency and hotfix PRs target it; successful main CI continues to publish immutable images, while deployment remains an operator action.

Bring the verified KeePass/passkey/Telegram change from #75 into main and integrate all 11 reviewed Dependabot PRs with their commit ancestry preserved. Use a merge commit for this integration PR so GitHub can recognize those dependency heads as merged.

Motivation and scope

Remove the separate dev-to-main promotion step for this binary. Update AGENTS/CLAUDE guidance, contributor/operator docs, repository skills, PR template, branch-path validation, Dependabot targets and policy tests. Retire dev only after its history is preserved in main.

Dependency updates: #55 (distroless digest), #57 (SQLite), #58 (ChaCha20Poly1305), #59 (canonical JSON), #61 (Hyper), #62 (rcgen), #64 (Buildx action), #65 (build/push action), #67 (Hatchling), #73 (Rust image digest), and #74 (Python image).

Resolve lockfile conflicts from the integrated lock and update only the intended dependencies. Adapt deprecated nonce conversion calls and explicitly enable crypto key zeroization. Match Python-image documentation and Hermes CI to Python 3.14.8.

Security impact

• Trust boundary changed: yes, through the KeePass/admin/Telegram implementation from Use KeePass with passkey admin and Telegram approvals #75; documented in docs/threat-model.md.
• Credential flow changed: yes, mapped read-only KDBX Password fields and an operator-only bot entry unlocked through passkey-authenticated HTTPS. No token/password env files.
• Main remains PR-only with required checks, force pushes blocked and administrators subject to protection. Immutable publication remains gated by successful CI on the exact main commit.
• Crypto migration preserves zeroization and the existing authenticated-encryption format; signed canonicalization, authorization, TLS and fail-closed tests pass.

Documentation

Updated current main-only workflow guidance and removed the unused promotion template. README, operator guides, contracts, examples, threat model, BotFather/E2E instructions and the Infisical comparison accompany the KeePass implementation. Relative links checked; AGENTS.md and CLAUDE.md match.

Verification

• mise run check on the complete integrated tree, at reduced CPU priority with sequential tasks and bounded workers.
• Connected offline KeePass/admin/Telegram/proxy/API E2E.
• Isolated Chrome owner UI/passkey proof.
• New main-only PR policy tests, including rejected invalid targets.
• Use KeePass with passkey admin and Telegram approvals #75's GitHub container, Rust, supply-chain, Hermes and CodeQL checks.
• Live Telegram and deployed firewall/container runtime behavior remain manual operator verification. Automated tests sent no real Telegram messages.

The old branch-path checks on retargeted dependency PRs reject main because their former policy permitted only promotion PRs. This integration includes the corrected policy and requires fresh passing checks before merge.

Risk and rollback

• Risk: dependency/runtime updates, KeePass configuration migration, passkey recovery, TLS provisioning, manual unlock after restart, and publishing on every successful main revision.
• Rollback: revert the affected changes through another main PR or deploy a previously published immutable image with matching configuration. Database/public passkey state remains operator-owned and backed up separately.