Ship specs through real CI

# Tanren — start here (for agents) Tanren turns specs into merged PRs — autonomously — through an agent workflow that runs each unit of work per-PR through real CI. v0 (Phases 0–3) is built and merged, and the real run loop is live-validated end-to-end across three tiers (easy/medium/hard, the hard one a private repo) — each reached a merged PR with real Codex + real credentials. v21 native delivery is the doctrine. Delivery is Action-less : the native shell-tier gate ( .tanren/ci.yml , a CiConfigV1 — not a GitHub Actions workflow) runs over SSH and feeds the sole merge authority ; the verdict publishes back to the forge as the tanren/gate commit status. Mergify is fully removed ( native queue is the merge engine); migrations are collapsed to a single baseline; the status vocabulary is unified; Vault per-run scoped credentials are done. (Tanren's own monorepo CI runs on GitHub Actions like any repo; the no-Actions doctrine governs the delivery path for the apps Tanren builds .) The tanren-owns-the-engine cutover is COMPLETE — it is the single live path. Delivery runs on the jj (jujutsu) WorkspaceVcsCore (jj-only, no git fallback), the guarante