v0.60.0

Three findings from broadening the validation corpus by shape — monorepos, reusable-workflow
fan-out, merge queues, a non-GitHub forge, a repository with no history.

• A repository that teaches CI contains CI files that are not its CI. A self-hosted-runner search
  matched three workflow files that turned out to be teaching material under course/content/. Scans
  now exclude testdata, fixtures and examples — and say the list is never complete, so the
  durable habit is to read the path of a match rather than only its count.
• No history has two causes with opposite remedies. A shallow clone is fixed by fetching; a
  repository that publishes squashed snapshots is a finding, because nobody can mine its incidents.
  They are indistinguishable until you check is-shallow-repository.
• A GitLab map. "Audit their equivalent" was the whole of the guidance for a non-GitHub host, and
  nothing had ever tested it. The questions that transfer are now mapped to their GitLab names,
  grounded in a real .gitlab-ci.yml: rules: on CI_PIPELINE_SOURCE == "merge_request_event",
  include: for fan-out, and component: pinned to a version string rather than a SHA.