ci: reconcile wanted main workflow updates

[lopugit]

Summary

• carry the warning-only Web CI labeling from main PR ci: make typecheck ratchet warning-only #222 into the reusable github-actions implementation
• carry the missing Admin-model contract from main that proves all 10 bounded rebase rounds receive the selected model arguments
• preserve the newer github-actions resolver, promotion, provider-routing, preview-DNS, and trusted-worker implementations instead of replacing them with older main copies
• refresh the tracked Graphify graph as a separate generated commit

Reconciliation notes

This branch starts at the current github-actions tip. The main and github-actions trees were compared file by file. Most shared CI files are newer on github-actions, so this PR intentionally ports only the two non-regressive deltas that were still missing.

The four-line model-handoff assertion is also the only useful source change currently stranded in #266; this PR applies it directly without the stale historical replay or Graphify cache churn from that promotion branch.

Related control-plane PRs: #234, #236, #266.

Validation

• all .github JavaScript syntax checks
• all .github shell syntax checks
• develop preview self-test: 43/43
• workflow control-plane contract
• conflict-resolver routing contract, including the new 10-round assertion
• promotion worker routing and shell contracts
• promotion changelog and promoter self-tests
• all workflow YAML parsed successfully
• git diff --check
• Graphify update, query, hook, merge-driver, and JSON validation

Local actionlint was unavailable; the live Workflow control-plane CI check remains the authoritative actionlint-equivalent gate for this PR.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
thingtime	Ready	Preview	Aug 16, 2026 2:07pm