Merge branch 'main' into fix/ci-required-drift-polling-sentinel

The Publish to PyPI step ran `twine upload` without --verbose. On an HTTP
403, twine's default output prints only the bare status ("Forbidden") and
discards PyPI Warehouse's human-readable response body, which carries the
actual rejection reason (e.g. project-scoped token mismatch, yanked-name
collision, account state). During the internal#469 0.1.1003 publish block
the missing reason body made root-cause diagnosis impossible without
performing another real upload to the live package.

Adding --verbose makes twine log the HTTP request/response metadata and
the Warehouse error body in CI. It does NOT echo the credential: the
PyPI token is passed via --password and sent only in the Basic-Auth
Authorization header, which twine's verbose output does not dump.

Minimal change: single added flag on the existing twine upload
invocation; no other steps or behavior touched.

Refs: internal#469

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/scripts/ci-required-drift.py

@@ -384,12 +384,22 @@ def detect_drift(branch: str) -> tuple[list[str], dict]:
     contexts = set(protection.get("status_check_contexts") or [])
 
     # ----- F1: job exists in CI but not under sentinel.needs -----
-    missing_from_needs = sorted(jobs - needs)
-    if missing_from_needs:
-        findings.append(
-            "F1 — jobs in ci.yml NOT under sentinel `needs:` (sentinel doesn't gate them):\n"
-            + "\n".join(f"  - {n}" for n in missing_from_needs)
+    # Gitea 1.22.6 polling sentinel pattern: `all-required` intentionally
+    # has no `needs:` (polls CI status directly via API). When needs is
+    # empty, all 5 CI jobs would appear "missing" — a false positive.
+    # Skip F1 when sentinel has no needs; the absence is by design.
+    if not needs:
+        sys.stderr.write(
+            f"::notice::sentinel '{SENTINEL_JOB}' has no `needs:` — "
+            "Gitea 1.22.6 polling pattern; skipping F1.\n"
         )
+    else:
+        missing_from_needs = sorted(jobs - needs)
+        if missing_from_needs:
+            findings.append(
+                "F1 — jobs in ci.yml NOT under sentinel `needs:` (sentinel doesn't gate them):\n"
+                + "\n".join(f"  - {n}" for n in missing_from_needs)
+            )
 
     # ----- F1b: needs lists a job that doesn't exist (typo) -----
     # Compare against jobs_all (incl. event-gated jobs); a typo is a

.gitea/workflows/publish-runtime.yml

@@ -162,6 +162,7 @@ jobs:
             exit 1
           fi
           python -m twine upload \
+            --verbose \
             --repository pypi \
             --username __token__ \
             --password "$PYPI_TOKEN" \