Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
Bot account registered via mas-cli, compatibility token issued and stored via sops. Adds an explicit NetworkPolicy allow-rule since Draupnir needs to reach Synapse's client-server API in-namespace, which the existing default-deny policy would otherwise silently block.