[snapetech]

This branch updates the Docker workflow's owner-PR path and keeps public-fork validation on its separate sandbox route. The owner path requires both action:ci and pool:private; its metadata job dispatches docker.yml from main without checking out PR code, and the child checks the recorded head with credentials disabled. Before posting a check, the reporter confirms that the PR is still open at that same head.

Public-fork code continues to use the disposable public-fork-jit route with no secrets. The other changes in this PR retain the existing package and image checks.

YAML parsing, the route contract audit, and embedded Python syntax checks pass locally. The route is not in main yet, so this PR cannot dispatch its own exact-head run. Packer's workflow map and private-JIT assignment are still pending; no build was started.

[snapetech]

Policy update: all 65 snapetech-org repositories are in scope. Every build, test, and security job must use a verified private JIT runner; do not use GitHub-hosted execution, legs, or fallback. Use platform-matched Linux, Windows, macOS, and ARM capacity. Keep Windows release jobs on the restored private Windows route named packer; never send them to Linux. Keep fork and untrusted code isolated from privileged runners, and retain all build, test, scanner, security, and publish checks. If a private route is unavailable, leave that job queued or blocked and report the repository, workflow, platform, and capacity gap. Coordinate allowlist and shared runner/broker changes with the policy owner. Preserve active releases and honor C0/current-slot-owner handoff before starting any job.