- boot-smoke: shutdown verdict now requires SIGTERM actually delivered and a
clean exit (code 0 or SIGTERM); EADDRINUSE port race retries with a fresh
port (3 attempts)
- test-changed: rename shouldForceFullSuite -> isSharedInfraChange (it routes
to gate mode, not full); run the changed-mode gate under the isolation guard
- workflows: least-privilege permissions (contents: read) on pr-checks and
full-suite
5aa6cad168