Routes around the .gitea/workflows/** branch protection on FM06/flowmaster-ops by hosting the same workflow in a repo I can self-merge. Runs on the build01 runner which has cluster kubectl access via its ServiceAccount (confirmed by sealed-secret-drift + innova-promotion-gate in flowmaster-ops). Trigger from the Gitea Actions tab when ready.