chore(stack): remove stack tooling, scope the draft lock, align docs

.github/pr-stack.json

@@ -1,8 +1,5 @@
 {
-  "upstreamRemote": "upstream",
-  "upstreamBranch": "main",
-  "forkChangesBranch": "fork/changes",
-  "integrationBranch": "fork/integration",
+  "_comment": "Allowlist for .github/workflows/managed-pr-draft-lock.yml only. The stack tooling that consumed the rest was removed; upstream is merged directly into fork/dev. These three PRs stay draft so the provenance layers can never be merged into the upstream mirror by accident.",
   "pullRequests": [
     {
       "number": 255,
@@ -15,61 +12,7 @@
     {
       "number": 27,
       "branch": "fork/candidates"
-    },
-    {
-      "number": 2,
-      "branch": "fork/changes"
     }
   ],
-  "integrationOverlays": [],
-  "conflictResolutions": [
-    {
-      "branch": "fork/integration",
-      "commit": "*",
-      "path": "pnpm-lock.yaml",
-      "strategy": "theirs"
-    },
-    {
-      "branch": "fork/integration",
-      "commit": "286efa51172d3cbf46684c9923ca9d2b003d0967",
-      "path": "pnpm-lock.yaml",
-      "strategy": "theirs"
-    },
-    {
-      "branch": "fork/integration",
-      "commit": "*",
-      "path": "AGENTS.md",
-      "strategy": "ours"
-    },
-    {
-      "branch": "fork/integration",
-      "commit": "46c3697f207ea2de04c0a9ef72ca867d4d9f01da",
-      "path": "AGENTS.md",
-      "strategy": "ours"
-    },
-    {
-      "branch": "fork/integration",
-      "commit": "*",
-      "path": "docs/fork-stack.md",
-      "strategy": "ours"
-    },
-    {
-      "branch": "fork/changes",
-      "commit": "*",
-      "path": "AGENTS.md",
-      "strategy": "theirs"
-    },
-    {
-      "branch": "fork/changes",
-      "commit": "206981716ef30b5fb58338e32653339ed958a7f7",
-      "path": "AGENTS.md",
-      "strategy": "theirs"
-    },
-    {
-      "branch": "fork/changes",
-      "commit": "*",
-      "path": ".github/workflows/ci.yml",
-      "strategy": "theirs"
-    }
-  ]
+  "integrationOverlays": []
 }

.github/workflows/managed-pr-draft-lock.yml

@@ -3,6 +3,14 @@ name: Managed PR draft lock
 on:
   pull_request_target:
     types: [opened, reopened, ready_for_review, synchronize]
+    # Only the bases the managed provenance PRs target. Ordinary work targets
+    # fork/dev, so this no longer starts a run -- and shows a check -- on every
+    # unrelated PR just to look itself up in an allowlist and exit.
+    #
+    # Not folded into Fork CI: that workflow deliberately does not watch main,
+    # and #255 targets main. Merging it would push fork CI plumbing into the
+    # upstream mirror, which is the single worst outcome this guard prevents.
+    branches: [main, fork/base, fork/tim]
 
 permissions:
   contents: read
@@ -23,7 +31,7 @@ jobs:
           manifest="$(
             gh api \
               -H 'Accept: application/vnd.github.raw+json' \
-              "repos/${REPOSITORY}/contents/.github/pr-stack.json?ref=fork/changes"
+              "repos/${REPOSITORY}/contents/.github/pr-stack.json?ref=fork/dev"
           )"
           if ! jq -e --argjson number "${PR_NUMBER}" \
             '([.pullRequests[], .integrationOverlays[]] | any(.number == $number))' \