ci: route protected verification locally

[promisepreston]

Summary\n- keep public pull-request verification on GitHub-hosted compute\n- route only protected main verification to preston-shared\n- preserve the credentialed Cloudflare deployment job on GitHub-hosted compute\n- synchronize the current protected main history into develop\n\n## Validation\n- Actionlint\n- git diff check

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f112ee95-3ee4-4699-b9a7-8faa27594604

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[promisepreston]

Closing after CI correctly enforced the public-repository trust boundary. RecordCove Preview verification and credentialed deployment remain GitHub-hosted by design under WO-013; no runner-routing change is required.