[ECorreia45]

Required daily-maintenance follow-up

• Recognize the exact GitHub CLI app/renovate and app/dependabot author identities alongside canonical [bot] identities, rejecting bare usernames, lookalikes, and explicit non-bots.
• Disable aider RepoMap with --map-tokens 0 in both AI paths, retaining explicit source targets and strict rejection of unexpected files. Successful edits no longer fail because aider created its own checkout cache.
• Add regressions exercising both actual workflow shell selectors, review/health gates, the three-repair cap, successful source edits, and continued rejection of unexpected caches.

Validation

39 local guard tests passed, plus Bash syntax, actionlint, Prettier, and git diff checks. No package source, dependencies, credentials, billing, permissions, or schedule changes. Exact-head CI will be verified before the authorized merge. No live maintenance dispatch.