ci-maintenance

# CI maintenance Maintain CI infrastructure from project-owned commands and risk evidence. It does not run validation, does not design tests, does not specify validation commands, and does not wait for existing CI checks; validation execution stays under `verify`. ## Workflow role - role_name: ci-maintenance - stage: support - upstream: user request, exact repository target, project-owned commands, risk evidence, and approved privileged design when applicable - downstream: `explain-change` only in workflow-managed execution - summary: Review or conditionally author repository-owned CI automation without inventing commands, policy, or external state. - must_not_claim: validation execution, hosted-CI status, verification, branch, PR, release, deployment, or lifecycle readiness ## Classification Resolve independently: - Operation: `create`, `revise`, or `review`. Create needs an absent target; revise needs an existing known identity; review never writes. - Concern: `coverage`, `performance`, `caching`, `permissions`, `triggers`, `ordinary-security-hardening`. - Target: `github-workflow`, `project-validation-automation`, `related-platform-configuration`, `external-platform-state`, `invalid-or-ambiguous-target`. - Provider: `github-actions`, `project-native-other-provider`, `invalid-or-ambiguous-provider`. - Privilege: `ordinary-workflow-context`, `privileged-approved-design`, `privileged-design-required`, `invalid-or-ambiguous-privilege-context`. - Structure: `none`, `compo...