chore(ci): slå ihop main i grenen och behåll kanonisk security-gate

.gitea/workflows/cd.yml

@@ -22,8 +22,9 @@ on:
 # Never let two deploys race the same Coolify app. Unlike CI we do NOT cancel an
 # in-flight deploy (it may already be restarting the container); the newest
 # commit still wins because Coolify builds from the branch head.
+# N6 (server-config ci/jobbstorm-2026-11-10 §4): deploy/release köas i en fast grupp och avbryts aldrig.
 concurrency:
-  group: deploy-0pt-main
+  group: ${{ gitea.workflow }}
   cancel-in-progress: false
 
 jobs:

.gitea/workflows/ci.yml

@@ -23,8 +23,9 @@ on:
 
 # One run per ref; a branch push that also updates a PR used to start two full
 # quality runs (and, on main, two deploy chains). Cancel the superseded one.
+# N6 (server-config ci/jobbstorm-2026-11-10 §4): en ny commit på samma PR/gren avbryter den inaktuella körningen.
 concurrency:
-  group: ci-${{ github.ref }}
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
   cancel-in-progress: true
 
 jobs:

.gitea/workflows/health-check.yml

@@ -3,6 +3,12 @@ on:
   workflow_dispatch:
   schedule:
     - cron: "0 6 * * 1"
+
+# N6 (server-config ci/jobbstorm-2026-11-10 §4): schemalagd/manuell körning köas i en fast grupp, avbryts inte.
+concurrency:
+  group: ${{ gitea.workflow }}
+  cancel-in-progress: false
+
 jobs:
   health:
     runs-on: ubuntu-latest

.gitea/workflows/masterplan-lock.yml

@@ -8,10 +8,14 @@ name: masterplan-lock
 
 on:
   push:
-    branches: ["**"]
+    branches: [main]
   pull_request:
   workflow_dispatch:
 
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
     runs-on: ubuntu-latest

.gitea/workflows/nightly.yml

@@ -8,9 +8,10 @@ on:
   schedule:
     - cron: "0 4 * * *"   # daily 04:00 UTC
 
+# N6 (server-config ci/jobbstorm-2026-11-10 §4): schemalagd/manuell körning köas i en fast grupp, avbryts inte.
 concurrency:
-  group: nightly-${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ gitea.workflow }}
+  cancel-in-progress: false
 
 jobs:
   quality:

.gitea/workflows/prod-smoke.yml

@@ -9,9 +9,10 @@ on:
   schedule:
     - cron: "*/30 * * * *"
 
+# N6 (server-config ci/jobbstorm-2026-11-10 §4): schemalagd/manuell körning köas i en fast grupp, avbryts inte.
 concurrency:
-  group: prod-smoke
-  cancel-in-progress: true
+  group: ${{ gitea.workflow }}
+  cancel-in-progress: false
 
 jobs:
   smoke:

.gitea/workflows/release.yml

@@ -40,8 +40,9 @@ on:
   workflow_dispatch:
 
 
+# N6 (server-config ci/jobbstorm-2026-11-10 §4): deploy/release köas i en fast grupp och avbryts aldrig.
 concurrency:
-  group: release-${{ github.ref }}
+  group: ${{ gitea.workflow }}
   cancel-in-progress: false
 
 env:

.gitea/workflows/vehiq-oltp-ingest.yml

@@ -16,6 +16,11 @@ on:
   schedule:
     - cron: "*/15 * * * *"
 
+# N6 (server-config ci/jobbstorm-2026-11-10 §4): schemalagd/manuell körning köas i en fast grupp, avbryts inte.
+concurrency:
+  group: ${{ gitea.workflow }}
+  cancel-in-progress: false
+
 jobs:
   extract:
     runs-on: ubuntu-latest

.gitleaksignore

@@ -16,3 +16,19 @@ d9c8f7190b312b03acb331522f4d55c0a2fe0e4a:tests/integration/analyst-sql-clickhous
 # kanariefågel som testet använder för att bevisa att hemligheter inte läcker i
 # analyst-SQL-svaret. Falsk positiv.
 829150fd0481191b4c96b52475ecc822e46a5fe7:tests/integration/analyst-sql-clickhouse.integration.test.ts:generic-api-key:71
+
+# .gitleaksignore — exakta fingeravtryck för granskade falska positiva.
+#
+# Genererad 2026-11-11 från gitleaks v8.30.1 (samma version som security-grinden
+# pinnar) körd som directory-scan mot repots arbetsträd. Varje rad nedan är
+# granskad: träffen är en testfixtur, ett exempelvärde i dokumentation, en
+# hash/UUID eller ett miljövariabelnamn — inte en hemlighet. Ingen bred ignore:
+# endast dessa exakta fil:regel:rad-fingeravtryck undertrycks; nya fynd fäller
+# fortfarande grinden. Fingeravtrycken förutsätter att katalogen monteras på
+# /repo (så gör den kanoniska security-workflowen).
+
+# Klassificering (katalog — regel: antal):
+#
+# `tests/integration` — generic-api-key: 1 träff(ar)
+
+/repo/tests/integration/analyst-sql-clickhouse.integration.test.ts:generic-api-key:71

siax/production-evidence/pe-0pt-829150fd0481.json

@@ -1,10 +0,0 @@
-{
-  "id": "pe-0pt-829150fd0481",
-  "repo": "0pt",
-  "evidenceType": "deploy-log",
-  "result": "pass",
-  "verifiedAt": "2026-11-10T10:04:54Z",
-  "verifiedBy": "coolify-deployment-db (application_deployment_queues, senaste finished-deploy)",
-  "proofRef": "coolify://deployment/https://0pt.app,https://api.0pt.app",
-  "sourceSha": "829150fd0481191b4c96b52475ecc822e46a5fe7"
-}

siax/signing/README.md

@@ -1,4 +1,4 @@
 # 0pt — cosign-signeringskedjan (2026-09-29)
 
-Prod-imagen git.cloud.siax.io/sax3l/0pt:prod-1e5fafce1a (sha256:80237edf1530110650cdfc6da8e821130d9a005cd47d79528d03dbeae2485822) är cosign-signerad
+Prod-imagen git.cloud.siax.io/sax3l/0pt:prod-116b1df3b8 (sha256:50c3fb070f21e3fc08cf80b78f73f9cba989074c222870e030a2a9e597222874) är cosign-signerad
 med nyckelparet vars pubkey ligger här. Privata nyckeln raderad efter signering.

siax/signing/cosign.pub

@@ -1,4 +1,4 @@
 -----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgomLeApgQ4ZWeypoU2LfjLIkuBCa
-hGwo5+pYW9ae3XMKauDUK17QwMXaSwJ2u9ulefai7+/Fiv3/4Jh8EciMVA==
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERHWjVOzdRfPM1NY3KVCZBNSq+BM7
+pkWaB59iqNSVjO5P/dvcd7YisP7z9M3p4yOKQwEQxek3/tBCfhNOPN0XJA==
 -----END PUBLIC KEY-----

siax/source-bundles/sb-0pt-829150fd0481.json

@@ -1,7 +0,0 @@
-{
-  "id": "sb-0pt-829150fd0481",
-  "repo": "0pt",
-  "commitSha": "829150fd0481191b4c96b52475ecc822e46a5fe7",
-  "branch": "main",
-  "producedAt": "2026-11-10T10:04:54Z"
-}