[sh1pt-actions-fleet]

Summary

• Add the fleet deployment audit, explicit readiness verdict, operational runbook, PIT migration plan, and five rollout phases.
• Bind each OpenBao repo role to the pinned reusable workflow ref and SHA; check out the reusable workflow's own source at that exact SHA.
• Harden the SSH receiver against symlink/traversal checkout paths, unsafe parent directories, mismatched remotes, and missing gate setup.
• Make the host gate fail closed on unsafe/missing locks and low memory; add root-only provisioning and regression coverage.
• Fix OpenBao certificate newline handling, pin third-party workflow actions, and cover unhealthy health responses.

Verification

• npm test: 31 passing.
• node --check, bash -n, ShellCheck, and git diff --check: passed.
• Disposable OpenBao 2.7.2 + SSH server test: synthetic pinned workflow SHA accepted, changed SHA rejected, certificate issued, approved commit deployed as non-root, host/path/command/branch/rollback checks rejected unauthorized cases, and health passed.

Rollout status

No production configuration or credentials were changed. PIT remains disabled and its existing root/static-key deployment remains intact. Real GitHub-issued OIDC, production OpenBao, dev2, and PIT service permissions remain unverified. The audit verdict is not production ready.