* ci: retain main tests and gate GA publication on tags
Refs QRun-IO/qqq-all#10. Preserve reviewed selectors; version pins remain separate and publication remains gated.
* ci: pin settings-safe QQQ orb 0.6.8
Use the reviewed immutable release tooling for QRun-IO/qqq-all#10.
* fix: align first-party Apache-2.0 declarations
Refs QRun-IO/qqq#923.
* build(#921): update AssertJ test dependency to 3.27.7
Apply the independently reviewed one-pin test dependency update. Preserve revision, parent, CI and production source. Full verify passes; tracking: QRun-IO/qqq#921.