- inline .gitea/ci/sync_tsl_playbook.sh into sync-tsl-playbook.yml
- clone over plain repo url; credentials flow through an ephemeral
GIT_ASKPASS helper removed in cleanup
- rewrite tests to extract and exercise the workflow run block
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Limit tsl-playbook publishing to generated bundle paths so existing branch-local files are not removed.
Add tests for preserving non-generated files and for creating a clean orphan target branch.