R2: separate ordinary CI from canonical artifact promotion

[eimyroot]

Bounded R2 remediation for current main HEAD 0dfd2d1.

Problem: ordinary CI contained a duplicated canonical-artifact job even though canonical artifact promotion is governed by the separate manual artifact-promotion workflow. This violates the existing contract test and causes npm test to fail.

Change: remove only the duplicated canonical-artifact job from .github/workflows/ci.yml. No deployment, governance, permission, secret, or production-target changes.

Local verification on exact source tree plus this diff: npm test, npm run verify, npm run build, npm run audit, npm run renderer:coverage, npm run release:gate, npm run release:full all PASS. Visual diversity matrix PASS with 4 distinct design modes, art directions, section fingerprints, and domains.

[eimyroot]

R2 audit update after explicit GO (2026-09-11):

• Canonical main remains 0dfd2d1.
• Candidate branch remains scoped to the CI/artifact-promotion separation. Current candidate head is 26b7d60; later commits are empty CI-trigger probes only.
• Repository GitHub Actions policy was changed from local_only to selected with exact allowed patterns only: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4; github_owned_allowed=false, verified_allowed=false, sha_pinning_required=false.
• After the policy change, multiple real pushes to the candidate branch still produced zero GitHub Actions workflow runs.
• A manual rerun of prior known CI run 34030106066 entered queued with jobs=[]; a separate stale run 34031255796 had been queued since 2026-09-06 with no jobs and a cancellation request was submitted.
• GitHub public status reports Actions operational, so no current platform-wide outage explains the repository-specific behavior.
• GitHub documentation notes a separate GitHub-controlled repository/account Actions disabled state that cannot be restored through ordinary repository Actions settings and requires GitHub Support review. Current evidence is consistent with such an external scheduling/account restriction, but the exact backend cause is not exposed by the available API.

Local deterministic verification for the actual code change remains PASS: tests, verify, build, audit, renderer coverage, package gate, full environment gate, browser integration, and visual diversity matrix.

Promotion remains FAIL-CLOSED: no merge and no production deployment until server-side CI produces auditable evidence.