Add stable Required CI, repair E2E ownership, make Qodana optional-state handling explicit, and document the desired protection policy.