ci: remediate organization Unity enrollment drift

[wallstop]

Problem

The central source-free organization audit reports 74 policy findings for this repository at exact default-branch commit 3d4bdd1cf7e7d36fa63fa622bee67272796bab03. This is a real fail-closed enrollment alert, not a Unity test run. Central tracker: build-lock #113. Retained sanitized artifact.

Finding summary: 8 each: missing classifier/gate/typed release/aggregate/return; 7 ineligible triggers; 6 each classifier/gate/release not always and missing acquire; 3 missing preflights.

The artifact contains repository, commit, workflow, job, classification, and reason codes only. Do not attach raw Unity logs, credential values, serials, tokens, PEMs, or matched source lines here.

Required remediation

• Ensure every paid-serial job uses an approved immutable central lock pin and acquires before activation.
• Keep Unity/writer credentials out of workflow/job scopes that make unrelated jobs license-capable; scope them only to the exact steps that require them.
• Preserve literal cancel-in-progress: false and fail-fast: false on licensed paths.
• Add fail-closed runner preflight, Unity return, central cleanup classification, typed always-run release, and the always-run final cleanup gate in the same physical runner lifecycle.
• Emit one truthful always-reporting Unity aggregate; runner absence, cancellation, missing outputs, or partial execution must remain red.
• Remove, disable without credential reachability, or fully harden latent Unity workflows. Keep supported triggers limited to reviewed trusted refs/events.
• Run repository static contracts, the affected real Unity lifecycle, and the central organization audit against the merged default-branch commit.

Acceptance criteria

• The central audit is complete and reports zero findings for this repository at its exact current default-branch commit.
• Every acquired path ends with confirmed cleanup or fail-closed quarantine/incident evidence; no skipped or ambiguous path reports green.
• Required aggregates and immutable pins are covered by data-driven contract tests.
• Paid Unity CI and default-branch CI are green on the final reviewed head, with no unresolved review threads.

Related: Ambiguous-Interactive/ambiguous-organization-build-lock#42, #44, #113.