Development record

A managed repository with no CI workflow gets no required status check from abcd ahoy remote apply (itd-2610290746077716), because no workflow reports one. iss-2610121535283764 proposed that abcd offer such a repository a minimal starter workflow, gitleaks plus abcd lint, and then require those checks. That was split out of itd-2610290746077716 because nothing in abcd writes a CI workflow yet. A correct one needs a gitleaks binary pinned by version and verified by checksum (the gitleaks Action needs a paid licence on organization repositories), abcd itself installed and verified in CI, and every action pinned by commit SHA so it passes the SHA-pinning baseline it would sit under.