- ci: reject a manual dispatch with tag "latest"; concurrency group per tag
- Dockerfile: declare GIT_COMMIT after the module download layer
- Makefile: docker-build targets linux/amd64 by default
- patch.go: no shared package-level pointers; main.go: no init()
- tests: assert that merge replaces managed listener content
- docs: flows.md startup section matches main.go; review saved to docs/reviews
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- /ship now commits and pushes with a branch guard and no longer tags;
/release tags vMAJOR.MINOR.PATCH and confirms before pushing
- operator-reviewer and go-operator-reviewer agents from egress-proxies-operator
- committed permission allowlist; settings.local.json ignored
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>