- ci: reject a manual dispatch with tag "latest"; concurrency group per tag
- Dockerfile: declare GIT_COMMIT after the module download layer
- Makefile: docker-build targets linux/amd64 by default
- patch.go: no shared package-level pointers; main.go: no init()
- tests: assert that merge replaces managed listener content
- docs: flows.md startup section matches main.go; review saved to docs/reviews
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- make check runs lint + vet + test-short; lint is pinned to the go.mod
toolchain so it works when the host Go is newer than golangci-lint's
- gofumpt main.go and patch.go; drop unused gatewayGroup/gatewayKind vars
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>