chore(ci): remove the unused signed-push action and its smoke test

.github/workflows/actions.lock

@@ -156,10 +156,6 @@ workflows:
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
         - 'step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25'
-    '.github/workflows/signed-push-smoke.yml':
-        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
-        - 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1'
-        - 'step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25'
     '.github/workflows/spark-theatre-gate.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/tag-ruleset-canon.yml':

.github/workflows/dependabot-lock-regen.yml

@@ -8,8 +8,8 @@
 # credentials and runs it.
 #
 # CREDENTIAL: the estate's dedicated applier App — vars.APP_ID and
-# secrets.APP_PRIVATE_KEY, the same slot apply-workflow-pins.yml and
-# signed-push read (owner ruling STD-R-3: NOT OikosBot, which is a ruleset
+# secrets.APP_PRIVATE_KEY, the same slot apply-workflow-pins.yml reads
+# (owner ruling STD-R-3: NOT OikosBot, which is a ruleset
 # bypass actor). Needs Contents R/W, Workflows R/W, Pull requests R/W (the
 # default-branch repair opens PRs), and must be installed on BOTH owners. Until
 # it exists the run warns and exits 0.

.github/workflows/tag-ruleset-canon.yml

@@ -61,7 +61,7 @@ jobs:
       # installed on BOTH owners (hyperpolymath and metadatastician).
       #
       # It is ALSO not the pin applier's App (vars.APP_ID, used by
-      # apply-workflow-pins, dependabot-lock-regen and signed-push-smoke). That App
+      # apply-workflow-pins and dependabot-lock-regen). That App
       # holds contents/workflows/pull-requests write; giving it administration:write
       # would let the thing that re-points pins also rewrite the rulesets that gate
       # it. Owner ruling 2026-10-08: two Apps, two slots.

config/README.adoc

@@ -347,17 +347,17 @@ tag. Creation is reserved to admins and to OikosBot (2538504) in `always`
 mode, so release workflows create tags *through the App*.
 
 That App credential does not exist yet. `hyperpolymath/standards` holds no
-`APP_ID` variable and no `APP_PRIVATE_KEY` secret (checked 2026-09-02;
-`signed-push-smoke.yml` has failed on every run since 2026-08-24 for that
-reason). Until the owner plants them (decision O11), the periodic
+`APP_ID` variable and no `APP_PRIVATE_KEY` secret (checked 2026-09-02, and
+again on 2026-10-19 when the last run of the since-removed `signed-push-smoke.yml`
+failed for that reason). Until the owner plants them (decision O11), the periodic
 `lock-refresh` and App-created tags cannot run; tags stay admin-only.
 
 There are *two* App slots on `hyperpolymath/standards`, one per duty (owner
 ruling 2026-10-08), and neither is OikosBot:
 
 * `vars.APP_ID` + `secrets.APP_PRIVATE_KEY` — the pin applier (contents,
-  workflows and pull-requests write). Read by `apply-workflow-pins.yml`,
-  `dependabot-lock-regen.yml` and `signed-push-smoke.yml`.
+  workflows and pull-requests write). Read by `apply-workflow-pins.yml` and
+  `dependabot-lock-regen.yml`.
 * `vars.RULESET_APP_ID` + `secrets.RULESET_APP_PRIVATE_KEY` — the ruleset
   applier (`administration: write`). Read by `tag-ruleset-canon.yml`.