MaidnCLI Delivery Procedure

Handoff

Do not leave completed changes only in a local worktree or branch.
Run git diff --check and the applicable Go checks before handoff.
Push each safe, scoped change on its own branch.
Open a Forgejo pull request for every completed branch unless the user explicitly authorizes a direct merge.
Return the PR URL. If Forgejo API access prevents PR creation, return the compare URL and state the exact API failure.
Never commit generated workspaces, .password, SOPS material, kubeconfigs, Terraform state, or recovery material.