feat: GitHub repo-host vertical with live-tests CI

.github/CODEOWNERS

@@ -0,0 +1,12 @@
+# Code owners for security-sensitive surfaces.
+#
+# Live-test fixtures + the CI workflow that drives them deal with
+# secrets that, if leaked, would let an attacker post comments,
+# cancel PRs, or mutate fixture state in our public test orgs.
+# Require explicit review on those paths.
+
+/.github/workflows/live-tests.yml      @goldenwitch
+/test-env/                             @goldenwitch
+/crates/devdev-test-env/               @goldenwitch
+/scripts/validate.ps1                  @goldenwitch
+/claims.toml                           @goldenwitch

.github/workflows/live-tests.yml

@@ -143,11 +143,15 @@ jobs:
           cargo run -p devdev-test-env --quiet -- --skip-ado print-env >> "$GITHUB_ENV"
 
       - name: seed gh CLI auth (consumer token)
+        # The `live_credential_chain::gh_cli_provider_yields_token`
+        # test exercises `gh auth token` and needs an authenticated
+        # gh CLI. We use a non-`GH_TOKEN` env var name because
+        # `gh auth login --with-token` refuses to run while
+        # `GH_TOKEN` is set in its environment.
         env:
-          GH_TOKEN: ${{ steps.gh_consumer.outputs.token }}
+          DEVDEV_LIVE_GH_LOGIN_TOKEN: ${{ steps.gh_consumer.outputs.token }}
         run: |
-          # Ensure the token never echoes (set -x off; redirect via stdin only).
-          printf '%s' "$GH_TOKEN" | gh auth login --with-token
+          printf '%s' "$DEVDEV_LIVE_GH_LOGIN_TOKEN" | gh auth login --with-token
           gh auth status
 
       - name: cargo test (live, --ignored)
@@ -161,11 +165,18 @@ jobs:
           DEVDEV_LIVE_WRITE: ${{ inputs.run_writes && '1' || '' }}
         run: |
           cargo test --workspace --locked --tests \
-            -- --ignored --skip live_workspace_cwd
+            -- --ignored \
+               --skip live_workspace_cwd \
+               --skip cargo_builds_hello_world_inside_mount
 
   cleanup:
-    needs: live-tests
-    if: always()
+    # Depend on `provision` (not just `live-tests`) so we can gate on
+    # whether the manifest-lock artifact actually exists. If `gate`
+    # skips the workflow or `provision` fails before upload, there's
+    # nothing to reset and downloading a missing artifact would turn a
+    # clean skip/failure into a confusing secondary cleanup failure.
+    needs: [provision, live-tests]
+    if: ${{ always() && needs.provision.result == 'success' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     environment: live-tests-admin