Acceptance Criteria
- #1 Image cleanup protects main-7573924 in addition to all existing stable/chart protections; ordinary unprotected edge-image expiry is unchanged.
- #2 Only the protected-tag input is changed; validation and review confirm no new publishing, deletion, credential, runner or permission behavior.
Definition of Done
- #1 just check (fmt-check, lint, gen-check, env-check, docs-check, test, race, hygiene, ui-check, compose-check, helm-test, lab-check, signal-fidelity)
- #2 just gen (only if a blueprint field, construct/workload config struct, or a skill under plugins/synthkit/skills/ changed)
- #3 just dump — inventory diffed against signals/
Implementation Plan
Add the verified main-SHA tag to the existing cleanup protection input only; preserve stable/current-chart tags and ordinary seven-day edge cleanup.
Implementation Notes
Landedclean2a0d861; exact fullcheck/privacy and hostedCI40042942502SUCCESS. Additive protected main-7573924 input only, existing protections and seven-day expiry unchanged. Pure declarative wiring: CodeRabbit not required; review and workflow validation retained. No generator or renderer changes; same-source inventory proof retained in runtime batch.