chore(sync): synced file(s) with cplieger/ci

.editorconfig

@@ -1,3 +1,4 @@
+# Synced from cplieger/ci/.editorconfig. Change it there.
 root = true
 
 [*]

.gitattributes

@@ -1,3 +1,4 @@
+# Synced from cplieger/ci/.gitattributes. Change it there.
 # Canonical line-ending + diff policy for all cplieger repos.
 #
 # Normalize every text file to LF in the repository and force LF on checkout,
@@ -7,9 +8,7 @@
 # LF-committed blobs. `text=auto` lets git detect binary files and leave them
 # untouched; `eol=lf` pins text checkouts to LF on every platform.
 #
-# Distributed to all releaseable + python repos via cplieger/ci's sync
-# workflow (see scripts/classify-repos.py). Keep this uniform across repos;
-# repos with extra needs (e.g. age-encrypted secret blobs) maintain their
+# Repos with extra needs (e.g. age-encrypted secret blobs) maintain their
 # own superset and are excluded from the sync.
 
 # Force LF for all text; auto-detect and leave binary files untouched.

.golangci.yaml

@@ -1,3 +1,4 @@
+# Synced from cplieger/ci/.golangci.yaml. Change it there.
 version: "2"
 
 run:

.gremlins.yaml

@@ -1,6 +1,5 @@
-# Central Gremlins (Go mutation testing) config — synced into every Go-having
-# consumer repo as `.gremlins.yaml`. Edit this file in cplieger/ci to change
-# the policy org-wide.
+# Synced from cplieger/ci/configs/gremlins.yaml. Change it there.
+# Central Gremlins (Go mutation testing) config for every Go-having repo.
 #
 # Source: distilled from per-repo analysis (cplieger/ci subagent research,
 # 2026-06-04). Patterns capture the common "unkillable without integration"

cliff.toml

@@ -1,3 +1,4 @@
+# Synced from cplieger/ci/configs/cliff-stable.toml. Change it there.
 # Version-bump policy. Stable (1.x+): standard semver.
 # feat -> minor; breaking -> major.
 # Fresh/untagged repos start at v1.0.0 (matches "0.x is the exception" policy).

scripts/collect-licenses.sh

@@ -1,8 +1,7 @@
 #!/bin/sh
+# Synced from cplieger/ci/configs/collect-licenses.sh. Change it there.
 # Copy every linked Go module's license files into the /usr/share/licenses tree of
 # attribution.md section 4. usage: collect-licenses.sh --name IMAGE [--out DIR] [--src DIR] [PACKAGE ...]
-# CANONICAL COPY in cplieger/ci (configs/collect-licenses.sh), synced to each
-# root-Dockerfile repo's scripts/collect-licenses.sh: edit it there, never here.
 # A module with no license file fails the build rather than being skipped, because a
 # missing text is a section 4(a) breach and the fix is a human decision.
 set -eu

scripts/repin-sha.sh

@@ -1,9 +1,8 @@
 #!/bin/sh
+# Synced from cplieger/ci/configs/repin-sha.sh. Change it there.
 # Recompute a Dockerfile sha256 integrity pin after Renovate moved its version
 # literal, run from postUpgradeTasks because no datasource publishes a sha256.
 # Marker convention and enrollment: ci-renovate.md, "Automated sha-pin recompute".
-# CANONICAL COPY in cplieger/ci (configs/repin-sha.sh), synced to every repo with a
-# root Dockerfile: edit it there, never here.
 # A marker it cannot honour exits non-zero rather than skipping, because a silent
 # miss reproduces the stale-pin build failure the pin exists to catch.
 set -eu

tests/image-smoke.sh

@@ -1,11 +1,10 @@
 #!/bin/sh
+# Synced from cplieger/ci/configs/image-smoke.sh. Change it there.
 # Runtime image smoke-test harness: start the assembled image, wait for the
 # container's own HEALTHCHECK to report healthy, fail fast on an early exit, dump the
 # container log tail only on failure. Per-app knobs and hooks come from
 # tests/image-smoke.conf beside this script; smoke-tests.md "Pattern B" documents
 # every knob, every hook and what each tier proves.
-# CANONICAL COPY in cplieger/ci (configs/image-smoke.sh), synced to each enrolled
-# app's tests/image-smoke.sh: edit it there, never here.
 set -eu
 
 IMG="${1:?usage: image-smoke.sh <image-ref>}"