The report hardcoded a probe for 'Cross-stack coherence', which
is no longer a required status check on main. Dump the live set
from required_status_checks.contexts[] and .checks[].context
instead, so the monthly report reflects whatever branch
protection is configured at that point rather than a stale name.
The 'Deploy to Tower' workflow built the Astro Node adapter and
scp'd it to Tower to run as a container on port 4321. Production
has been served by Cloudflare since PR #5, so this pipeline only
ever fails (Tower SSH secrets are stale and the target host is
not the live origin). Removing it eliminates noisy red runs.
Remove continue-on-error on the Typecheck step: astro check
currently reports 0 errors / 13 hints, so the step can block.
Also run tracking:check and image:budget after the build so these
quality gates actually fail CI when broken (they are defined in
package.json but were never wired into the workflow).