merge: code queue claim move race fix

# Conflicts:
#	AGENTS.md
#	TEST.md
#	config.json
#	deploy.json
#	docs/reference/cli.md
#	docs/reference/deploy.md
#	docs/reference/microservices.md
#	scripts/cli.ts
#	scripts/src/check.ts
#	scripts/src/e2e.ts
#	scripts/src/remote.ts
#	src/components/microservices/code-queue/src/index.ts
#	src/components/microservices/code-queue/src/queue-api.ts
#	src/components/microservices/decision-center/Dockerfile
#	src/components/microservices/decision-center/src/index.ts

docs/reference/repo-tree.md

@@ -18,6 +18,7 @@
       - command.ts (Bounded command execution helpers)
       - output.ts (JSON output helpers)
       - e2e.ts (Public frontend/provider ingress, internal core/database, and Playwright frontend E2E checks)
+      - ci.ts (D601 k3s Tekton CI install/status/manual-run/logs helpers; CI only, no CD)
   - logs/ (Generated service logs; ignored by git)
   - .state/ (Generated job state and compose env; ignored by git)
   - docs/
@@ -32,6 +33,7 @@
       - provider-gateway.md (Provider connection and host SSH maintenance bridge)
       - observability.md (Logs and status visibility)
       - e2e.md (Delivery gate, Playwright frontend E2E, and database persistence checks)
+      - ci.md (D601 k3s Tekton CI, read-only production database performance gate, and trigger boundary)
   - src/ (TypeScript component monorepo)
     - package.json (Component workspace metadata)
     - bun.lock (Component dependency lockfile)
@@ -91,4 +93,5 @@
         - oa-event-flow/ (Unified OA event ledger, tag stream, and Trace/STEP stats center)
         - decision-center/ (Decision records backend; k3s-managed on D601 and PostgreSQL-backed)
         - k3sctl-adapter/ (D601 k3s control-plane adapter and managed service manifests)
+          - k3s/ci/ (Tekton CI install marker, Pipeline/Task, and in-cluster Trigger manifests)
         - example-service/