Run scheduled and manually dispatched credentialed live confidence

[altaywtf]

Outcome

Run a bounded credentialed live-confidence lane from main on a schedule and by manual dispatch, using the existing PUTIO_SDK_TYPESCRIPT_SOPS_FILE consumer contract and runner-owned age delivery.

Raised from #108. Repository-side SOPS rendering and fresh-token lifecycle support already exist. Implementation remains blocked until the runner can supply a scoped age identity and ciphertext path through an environment-owned delivery contract.

Acceptance criteria

• The workflow is limited to main, supports workflow_dispatch, and has an explicit bounded schedule.
• Public pull-request verification remains secret-free and never depends on private repositories.
• The runner supplies the ciphertext location and scoped age identity; neither is embedded in this repository.
• Runtime tokens are minted ephemerally and revoked during teardown, including after test failure.
• Concurrency prevents overlapping mutation-heavy runs against the shared fixtures.
• Targets are fixed and allowlisted; the default lane starts with safe account/tunnel smoke before broader groups are enabled.
• Logs and retained artifacts expose only public-safe status and contract-drift evidence.
• Missing identity, ciphertext, fixture readiness, and test failure are distinguishable fail-closed outcomes.
• One manual run and one scheduled run pass on the committed main workflow.

Verification

• vp run verify
• vp run lint:package
• vp run test:compat
• Linked successful manual and scheduled workflow runs.

Boundaries

Do not copy private ciphertext into this repository, store age private material in GitHub repository secrets, reintroduce Infisical, or make public PR CI depend on credentials.