Two independent parts.
**Release delivery.** `v` tags publish on the release event, in a new Release Images workflow, rather than from whichever Deploy run survives the concurrency queue. Deploy now queues FIFO instead of discarding superseded runs, and ships only build tags. Release Images waits out that commit's Deploy, then retags the matching `sha-` image per app, or builds from the tag tree when none exists; it is re-runnable against any tag.
**PR image gating.** build-check runs on every PR and aggregates into one `Result` check, so image builds become requirable in branch protection. The per-app job names are dynamic and cannot be.
* feat(monk): add monk, a measured ceph scrub-backlog exporter
* fix(monk): harden collection failure paths
* docs(monk): defer the deploy role reference to its follow-up PR
* fix(monk): emit the age distribution as a real histogram and document operational contracts
* feat(monk): read overdue targets from the cluster instead of flags
* ci(monk): register the monk image build filter
* chore(monk): cut comments the types already carry
Paul Makles
Andy Molenda
Antoine Lecompte