"""Compliance harness for the gitea-workflow skill (issue #156).

Layers on top of the third-party skill-comply runner without depending on
it: pinned spec + drift detection, a loopback-only mock Gitea target,
deterministic run verdicts (compliant / noncompliant / inconclusive), and
a safety rail that refuses credentialed scenario runs against live hosts.
"""