Lint flagged false positives on audit reports + CHANGELOG that self-reference forbidden strings as findings. Restrict scan to kickstart/, overlay/, scripts/, assets/, build/ — actual ship state.
CI builds in fresh Fedora 43 container — matched pcre2/libselinux/selinux-policy versions, no fix-repo hack needed. Container starts every run from clean state, no zombie collisions. Fastest path to first green ISO.