Actions governance demo

This repository demonstrates CI governance without starting work on push or on a schedule. Every active workflow is manual-only (workflow_dispatch).

Planned demonstrations include:

• pause versus drain versus disable for a runner;
• organization-required workflows;
• trusted and protected runner labels;
• immutable action pinning and action-source allowlists;
• token-permission ceilings, secret release policy, quotas, and concurrency;
• an instance or organization scheduled-workflow kill switch.

The file under fixtures/workflows has a .txt suffix and is not executable. It exists solely to test schedule detection and policy previews.