S19: consume versioned engineering resources and move landscape documentation

.gitea/workflows/build.yaml

@@ -19,21 +19,23 @@ jobs:
         uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           persist-credentials: false
+      - name: Verify pinned engineering resources
+        run: python3 scripts/engineering.py --check
       - name: Identify workflow attempt
         # Gitea 1.25 does not populate gitea.run_attempt. Use a unique value for
         # container names and diagnostic artifacts, including reruns of one SHA.
-        run: java ci/Ci.java attempt
+        run: java generated/ci/Ci.java attempt
       - name: Build and test both images
-        run: java ci/Ci.java verify
+        run: java generated/ci/Ci.java verify
       - name: Publish verified main images
         if: success() && gitea.ref == 'refs/heads/main'
         env:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-        run: java ci/Ci.java publish
+        run: java generated/ci/Ci.java publish
       - name: Collect diagnostics and clean up test containers
         if: always()
-        run: java ci/Ci.java cleanup
+        run: java generated/ci/Ci.java cleanup
       - name: Retain diagnostics for fourteen days
         if: always()
         uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5

.gitea/workflows/deploy.yaml

@@ -42,8 +42,10 @@ jobs:
         uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           persist-credentials: false
+      - name: Verify pinned engineering resources
+        run: python3 scripts/engineering.py --check
       - name: Identify workflow attempt
-        run: java ci/Ci.java attempt
+        run: java generated/ci/Ci.java attempt
       - name: Release verified images — persistent PostgreSQL storage
         env:
           RELEASE_MODE: ${{ inputs.mode }}
@@ -57,7 +59,7 @@ jobs:
           DEPLOY_REGISTRY: ${{ vars.DEPLOY_REGISTRY }}
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
           DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
-        run: java ci/Ci.java deploy
+        run: java generated/ci/Ci.java deploy
       - name: Retain deployment diagnostics for fourteen days
         if: always()
         uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5

.gitea/workflows/rollback.yaml

@@ -19,8 +19,10 @@ jobs:
         uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           persist-credentials: false
+      - name: Verify pinned engineering resources
+        run: python3 scripts/engineering.py --check
       - name: Identify workflow attempt
-        run: java ci/Ci.java attempt
+        run: java generated/ci/Ci.java attempt
       - name: Restore previous successful release — requires a compatible database schema
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
@@ -31,7 +33,7 @@ jobs:
           DEPLOY_REGISTRY: ${{ vars.DEPLOY_REGISTRY }}
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
           DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
-        run: java ci/Ci.java rollback
+        run: java generated/ci/Ci.java rollback
       - name: Retain deployment diagnostics for fourteen days
         if: always()
         uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5