hygiene: prepare MobilityOps for public release

.gitea/workflows/browser-canary.yml

@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   chromium:
-    runs-on: linux-validation
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

.gitea/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
   acceptance:
     # Never execute code from an untrusted public fork on the private runner.
     if: ${{ gitea.event.pull_request.head.repo.full_name == gitea.repository }}
-    runs-on: linux-validation
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

.gitea/workflows/live-canary.yml

@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   public-probe:
-    runs-on: linux-validation
+    runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
       - name: Verify HTTPS readiness and certificate horizon

.gitea/workflows/managed-validation.yml

@@ -1,8 +1,6 @@
 name: Managed validation
 
 on:
-  push:
-    branches: [master]
   workflow_dispatch:
     inputs:
       profile:
@@ -22,7 +20,7 @@ concurrency:
 jobs:
   full:
     name: full
-    runs-on: linux-validation
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

.gitea/workflows/release.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   release-evidence:
-    runs-on: linux-validation
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Build commit-labelled release images

.gitea/workflows/security.yml

@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   images:
-    runs-on: linux-validation
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

.gitea/workflows/unraid-deploy.yml

@@ -0,0 +1,31 @@
+name: Unraid autoredeploy
+
+on:
+  push:
+    branches: [master]
+    paths-ignore:
+      - ".gitea/**"
+      - "docs/**"
+      - "**/*.md"
+  workflow_dispatch:
+
+concurrency:
+  group: unraid-production-mobilityops
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    name: Deploy mobilityops
+    runs-on: unraid-deploy
+    timeout-minutes: 180
+    steps:
+      - name: Deploy exact Gitea revision
+        run: |
+          set -euo pipefail
+          docker exec gitea-deploy-control \
+            /opt/gitea-deploy/deploy.py deploy \
+            "$GITHUB_REPOSITORY" "$GITHUB_SHA"
+

frontend/playwright.config.ts

@@ -6,10 +6,6 @@ export default defineConfig({
   // it mutates demo data via a reset and is run explicitly, not as part of the suite.
   testIgnore: process.env.CAPTURE_EVIDENCE === "1" ? undefined : "**/_*.spec.ts",
   timeout: 30_000,
-  // CI exercises the browser while image scans and container services share the
-  // same runner. Keep assertions strict, but allow successful API-backed route
-  // transitions enough time to render under that bounded load.
-  expect: { timeout: 15_000 },
   fullyParallel: false,
   workers: 1,
   snapshotPathTemplate: "{testDir}/__screenshots__/{arg}{ext}",

n8n/workflows/MANIFEST.md

@@ -121,4 +121,4 @@ this handler was not observed live.
 | Active status | Imported inactive by default; production deployment must publish it before enabling Alertmanager. |
 | Error Workflow | `Fleet Ops — Workflow Error Handler` (wired) |
 | Safety | Strict Alertmanager payload shape, bounded to 25 alerts and bounded text fields. |
-| Checksum (sha256) | `4eb1ae41c4e675a9bb51a43722a507da8a6eae8a6ce8649b7e3a57417911a418` |
+| Checksum (sha256) | `3672ad3d14b65c603c8c3f2067197cc50372e9d4c2fc314d1c9b6aaf3ecef444` |