ci: fix the Codex review findings on the template CI port

.github/workflows/main-estate-audit.yml

@@ -56,7 +56,12 @@ jobs:
           done
 
           echo "=== cicd-suite: spdx-license-check ==="
+          # Mirrors cicd-suite actions/spdx-license-check at this pin: a root
+          # licence file is enforced; no SPDX line anywhere is only a warning.
           test -f LICENSE.txt || test -f LICENSE || test -f LICENSE.md || test -f LICENSE.adoc
+          if [ "$({ git grep -i "SPDX-License-Identifier" || true; } | wc -l)" -eq 0 ]; then
+            echo "::warning::No SPDX-License-Identifier lines found in the repository."
+          fi
 
           echo "=== cicd-suite: idris2-abi & zig-unified-api-adapter ==="
           if find . -name '*.zig' -not -path './.git/*' | grep -q .; then

.github/workflows/secret-scanner.yml

@@ -67,18 +67,22 @@ jobs:
       - name: Gitleaks working-tree pass
         run: |
           set -euo pipefail
-          CONFIG=".gitleaks-estate.toml"
+          # The estate baseline always runs; a repository .gitleaks.toml adds a
+          # second pass and can never stand in for the baseline.
+          CONFIGS=(".gitleaks-estate.toml")
           if [ -f .gitleaks.toml ]; then
-            CONFIG=".gitleaks.toml"
+            CONFIGS+=(".gitleaks.toml")
           fi
-          "$RUNNER_TEMP/gitleaks" detect \
-            --source . \
-            --no-git \
-            --redact \
-            --no-banner \
-            --verbose \
-            --config "$CONFIG" \
-            --exit-code 1
+          for CONFIG in "${CONFIGS[@]}"; do
+            "$RUNNER_TEMP/gitleaks" detect \
+              --source . \
+              --no-git \
+              --redact \
+              --no-banner \
+              --verbose \
+              --config "$CONFIG" \
+              --exit-code 1
+          done
 
       - name: Gitleaks full-history pass
         run: |
@@ -87,17 +91,21 @@ jobs:
             echo "::error::checkout is shallow; refusing vacuous history scan"
             exit 1
           fi
-          CONFIG=".gitleaks-estate.toml"
+          # The estate baseline always runs; a repository .gitleaks.toml adds a
+          # second pass and can never stand in for the baseline.
+          CONFIGS=(".gitleaks-estate.toml")
           if [ -f .gitleaks.toml ]; then
-            CONFIG=".gitleaks.toml"
+            CONFIGS+=(".gitleaks.toml")
           fi
-          "$RUNNER_TEMP/gitleaks" detect \
-            --source . \
-            --redact \
-            --no-banner \
-            --verbose \
-            --config "$CONFIG" \
-            --exit-code 1
+          for CONFIG in "${CONFIGS[@]}"; do
+            "$RUNNER_TEMP/gitleaks" detect \
+              --source . \
+              --redact \
+              --no-banner \
+              --verbose \
+              --config "$CONFIG" \
+              --exit-code 1
+          done
 
       - name: Gitleaks AsciiDoc mirror pass
         run: |
@@ -117,17 +125,21 @@ jobs:
             echo "No AsciiDoc files present."
             exit 0
           fi
-          CONFIG="$PWD/.gitleaks-estate.toml"
+          # The estate baseline always runs; a repository .gitleaks.toml adds a
+          # second pass and can never stand in for the baseline.
+          CONFIGS=("$PWD/.gitleaks-estate.toml")
           if [ -f .gitleaks.toml ]; then
-            CONFIG="$PWD/.gitleaks.toml"
+            CONFIGS+=("$PWD/.gitleaks.toml")
           fi
-          "$RUNNER_TEMP/gitleaks" detect \
-            --source "$MIRROR" \
-            --no-git \
-            --redact \
-            --no-banner \
-            --config "$CONFIG" \
-            --exit-code 1
+          for CONFIG in "${CONFIGS[@]}"; do
+            "$RUNNER_TEMP/gitleaks" detect \
+              --source "$MIRROR" \
+              --no-git \
+              --redact \
+              --no-banner \
+              --config "$CONFIG" \
+              --exit-code 1
+          done
 
   shell-secrets:
     name: "scan / shell-secrets"

CHANGELOG.adoc

@@ -1,5 +1,21 @@
 == Changelog
 
+== 2026-10-27 — Review fixes for the template CI port
+
+* `build/just/repo-init.just` is the template's at `8034fc9`, verbatim as
+  `.machine_readable/mint-verbatim.txt` lists it. The port brought the
+  template's mint scripts but kept the older generator, which called
+  `strip-instruction-blocks .` (the new tool takes a file list), ignored the
+  verbatim manifest and mapped the index instead of the worktree. The
+  generator's tests still are not ported; they need template-only inputs.
+* Secret Scanner always runs the estate gitleaks baseline. A repository
+  `.gitleaks.toml` adds a second pass. Before, it replaced the baseline, so a
+  pull request could pass with a weaker local config.
+* `scripts/check-required-contexts.sh` also requires a job whose check-run
+  name is the mapped context, so a renamed job cannot strand pull requests.
+* The inlined SPDX step mirrors cicd-suite's gate at its pin, including its
+  warning when no SPDX line exists.
+
 == 2026-10-27 — CI follows standards to metadatastician/standards
 
 * `hyperpolymath/standards` moved to `metadatastician/standards`. A