fix: enforce trustworthy quality snapshots - #505

PR classified as team-member.

✅ Head commit 2425a46 is signed by karthiknadig with trusted key 65CAC28268EDBD935D627BF34DC9FC7E9D93EA2A — approval requirement reduced from 2 to 1.

✅ Collaborator approvals: 1/1 (hediet).

✅ No newly added runnable binary files.

✅ No protected engineering system files changed.