- inline .gitea/ci/sync_tsl_playbook.sh into sync-tsl-playbook.yml
- clone over plain repo url; credentials flow through an ephemeral
GIT_ASKPASS helper removed in cleanup
- rewrite tests to extract and exercise the workflow run block
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>