v1.9 — sobelow --skip honours @sobelow_skip annotations

v1 → v1.9

CD: refuse superseded deploys; add version_path deploy verification

ci: guard that Fly apps ship a valid rel/env.sh.eex (clustering) + do…

…cs + template (#22)

A fleet-wide gap surfaced: apps ran DNSCluster but had no node-naming env (or keyed
it on the per-deploy image ref), so their machines never clustered and LiveView
reconnect-looped once a 2nd machine autostarted — silent until scaled. Add:

- elixir-ci: for `profile: app`, fail if the repo uses DNSCluster but rel/env.sh.eex
  is missing, keys the node on FLY_IMAGE_REF, or doesn't set RELEASE_NODE.
- STANDARDS.md §4.1: the clustering requirement + how to verify.
- templates/rel-env.sh.eex: the canonical, app-agnostic file to copy.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

feat(ci): reusable weekly Security Audit workflow (mix hex.audit -> r…

…olling issue) (#17)

A per-repo caller triggers this on a schedule. Runs mix hex.audit and keeps one
rolling GitHub issue in sync (open/update on findings, close when clean) —
Dependabot-style. Stays green regardless so no-fix advisories don't spam failure
emails. Auth mirrors elixir-ci.yml (HEX_ORG_KEY). Caller must grant issues: write.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

v1.5 — resilient gitleaks binary fetch (retry + cache); transient rel…

…ease-CDN 5xx no longer hard-fails CI (#16)

v1.4 — CI uploads cobenian-scan-posture artifact for Foundry (#106 Op…

…tion A) (#13)

v1.3 — reusable Fly deploy workflow (workflow_call): retry + --wait-t…

…imeout 15m + smoke test

v1.2 — key deps/_build + Dialyzer PLT caches on OTP/Elixir version (#3)

v1.1: private Hex org auth before deps.get