CI pipelines

The sync check never writes and exits non-zero on drift, so any CI system can run it as a step. The workspace’s CI policy records what should fail the build: drift, unapproved packages, yanked or deprecated versions, providers outside an allowed list.

For registry commands in CI, create a service account (role ci:agent by default) and use its wl_ token instead of a person’s.