ci: G11.5 resolved — onboard windy-pro; cloud cells + windytalk; promote script

- import_from_github.py no longer refuses windy-pro: lane 8c audited all
  14 checkouts (WINDYPRO_CHECKOUTS.md), GitHub main is canonical.
- sync + bridge: windy-cloud-domains, windy-cloud-vps, windytalk (default
  branch master), windy-pro; windy-cloud-sites added to the bridge (it was
  synced but never bridged).
- scripts/promote_to_ci.sh: the mirror->writable procedure as one script,
  with the delete-before-import hazard documented.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/import_from_github.py

@@ -229,13 +229,12 @@ def main() -> int:
     if not targets:
         ap.error("name a repo, or pass --safe-batch / --list-candidates")
 
-    if "windy-pro" in targets:
-        sys.exit(
-            "REFUSING windy-pro. Six checkouts exist, the build counter has forked "
-            "three ways (main 12 / overnight 34 / wave-44 56), and two sessions "
-            "recorded different HEADs hours apart. Resolve which is current and "
-            "write it down BEFORE importing (G11.5)."
-        )
+    # G11.5 RESOLVED 2026-09-23 (lane 8c, ~/windy-orchestra/WINDYPRO_CHECKOUTS.md):
+    # a read-only audit of all 14 windy-pro checkouts on 5 machines found GitHub
+    # main is canonical (Kit 0 prod and Windy 0 sit exactly on it; the others are
+    # stale, not divergent). Phase 1 keeps GitHub the source of truth anyway, so a
+    # writable Windy Git copy is CI only. Its six deploy/release workflows must be
+    # disabled on import — see docs/CUTOVER.md.
 
     if args.mirror:
         print("mirror mode: repos will be read-only and will NOT run CI.\n")

scripts/pr_status_bridge.py

@@ -47,7 +47,8 @@ REPOS = os.environ.get(
     "BRIDGE_REPOS",
     "windy-chat windy-mail windy-calendar Windy-Clone WindyCloud windy-search windy-connect"
     " windy-drops windy-code-web windy-code windy-traveler windy-registry eternitas"
-    " windy-translate windytranslate-site windytraveler-site windy-hand",
+    " windy-translate windytranslate-site windytraveler-site windy-hand"
+    " windy-cloud-sites windy-cloud-domains windy-cloud-vps windytalk windy-pro",
 ).split()
 
 # Gitea run status -> GitHub status state. `skipped` is deliberately absent: a

scripts/promote_to_ci.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# promote_to_ci.sh <repo> [workflow-to-disable ...] — pull mirror -> writable CI repo.
+# Run ON Veron as root. See docs/CUTOVER.md "Onboarding another private repo".
+#
+# ⚠️ It DELETES the mirror before importing (Gitea's migrate refuses an existing
+# name). If the import then fails, the Windy Git copy is gone until you re-run —
+# GitHub and the nightly R2 bundles still hold everything, but check first that
+# scripts/import_from_github.py will accept the repo. (2026-09-23: windy-pro was
+# deleted this way while the importer still refused it by name.)
+set -euo pipefail
+set -a; . /srv/windygit/src/.env; set +a
+export IMPORT_GITEA_URL=http://localhost:3080
+A=http://localhost:3080/api/v1; H="Authorization: token $GITEA_ADMIN_TOKEN"; r=$1; shift
+info=$(curl -s -H "$H" $A/repos/windyadmin/$r)
+m=$(echo "$info" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("mirror"))')
+if [ "$m" = True ]; then
+  curl -sf -o /dev/null -X DELETE -H "$H" $A/repos/windyadmin/$r
+  (cd /srv/windygit/src && python3 scripts/import_from_github.py "$r" | tail -1)
+elif [ "$m" = False ]; then echo "$r already writable"; else echo "$r absent -> importing"; (cd /srv/windygit/src && python3 scripts/import_from_github.py "$r" | tail -1); fi
+db=$(curl -s -H "$H" $A/repos/windyadmin/$r | python3 -c 'import json,sys;print(json.load(sys.stdin).get("default_branch","main"))')
+for i in $(seq 1 120); do curl -sf -o /dev/null -H "$H" $A/repos/windyadmin/$r/branches/$db && break; sleep 5; done
+for w in "$@"; do printf "  disable %s: " "$w"; curl -s -o /dev/null -w '%{http_code}\n' -X PUT -H "$H" $A/repos/windyadmin/$r/actions/workflows/$w/disable; done
+curl -s -H "$H" $A/repos/windyadmin/$r/actions/workflows | python3 -c 'import json,sys,os;print("  "+os.environ.get("R",""),[(w["path"].split("/")[-1],w["state"]) for w in json.load(sys.stdin).get("workflows",[])])'
+echo "  default=$db"

scripts/sync_from_github.sh

@@ -38,7 +38,7 @@ FAILED=0
 
 # Repos Windy Git tracks FROM GitHub. Remove a repo from this list at the moment
 # it flips to Windy-Git-first, or the sync will fight its authors and win.
-REPOS="${SYNC_REPOS:-windy-calendar windy-search windy-registry Windy-Clone WindyCloud windy-cloud-sites windy-mind eternitas windy-agent windy-git windy-chat windy-mail windy-connect windy-drops windy-code-web windy-code windy-traveler windy-translate windytranslate-site windytraveler-site windy-hand}"
+REPOS="${SYNC_REPOS:-windy-calendar windy-search windy-registry Windy-Clone WindyCloud windy-cloud-sites windy-mind eternitas windy-agent windy-git windy-chat windy-mail windy-connect windy-drops windy-code-web windy-code windy-traveler windy-translate windytranslate-site windytraveler-site windy-hand windy-cloud-domains windy-cloud-vps windytalk windy-pro}"
 
 mkdir -p "$WORK"
 log() { printf '[sync %s] %s\n' "$(date -u +%H:%M:%SZ)" "$*"; }