Adds a preflight guard to operator-bypassed repo rename so it refuses when the repository publishes reusable workflows or actions that other repositories reference, since GitHub does not redirect those references after a rename. The check fails closed when it cannot verify the repository is safe (API errors, truncated trees, unparseable workflow YAML, or limits).
Operators can override the refusal with GH_SHIM_RENAME_PUBLISHED=allow, which still runs the bounded inspection but records the published paths or unverified reason in the operator audit.
New refusal codes gh_shim_rename_published and gh_shim_rename_unverified are added to the closed set.
Process-tree cleanup for preflight timeouts is shared across the crate, and the timeout tests now tolerate loaded runners.
Confidence Score: 5/5
The PR appears safe to merge; no new actionable issue was found.
Summary
Adds a preflight check before operator-bypassed repo rename to detect reusable workflows and actions.
Operator-bypassed repository renames check for published actions and workflows.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Operator-bypassed repo rename] --> B[Inspect repository]
B --> C{Safe or explicit override?}
C -->|No| D[Refuse rename]
C -->|Yes| E[Write and sync audit]
E --> F{Audit saved?}
F -->|No| D
F -->|Yes| G[Delegate to gh]
