verbb/workflow

Repo bus factorcaution

All 24 recent commits came from one contributor, creating a meaningful continuity risk; organization ownership provides some handoff capacity but does not remove the concentration.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance-hygiene gap.

Workflow auditcaution

The sole workflow was fully analyzed, uses read-only permissions, and has no reported audit findings or untrusted-code sinks. However, all four action references are unpinned, weakening build reproducibility and supply-chain hygiene.