All Laravel app CI (tests, lint, security) runs on the Proxmox ARC fleet via reusable workflows — not GitHub-hosted minutes.

Do not copy inline ubuntu-latest CI YAML. Use thin callers:

jobs:
  tests:
    uses: K2-Rocket-Apps/ci-workflows/.github/workflows/tests.yml@v1
    secrets: inherit

Same for lint.yml and security.yml. See ci-workflows README.

• ci-workflows/.github/workflows/auto-merge.yml — lightweight Dependabot control plane
• Site audit tooling (Lighthouse, pa11y) until pointed at preview URLs
• Release/split automation (packages/split.yml)
• AI review bots (helm-deploy-broker claude/ai-review)

Spin apps from laravel-skeleton. It already wires tests/lint/security/auto-merge to @v1.

1. Actions → General → Access: reusable workflows from ci-workflows allowed for all org repos (already set).
2. Org secrets: FLUX_USERNAME, FLUX_LICENSE_KEY, COMPOSER_GITHUB_TOKEN (for secrets: inherit).
3. Runners: org-level ARC scale set k2-arc-linux on Proxmox — do not register repo-level runners.