- boot-smoke: shutdown verdict now requires SIGTERM actually delivered and a clean exit (code 0 or SIGTERM); EADDRINUSE port race retries with a fresh port (3 attempts) - test-changed: rename shouldForceFullSuite -> isSharedInfraChange (it routes to gate mode, not full); run the changed-mode gate under the isolation guard - workflows: least-privilege permissions (contents: read) on pr-checks and full-suite