The manual path stays normal until you demote it

## Spark

From the 2026-08-22 digest. `alunduil-infrastructure` closed two issues in
the same session: one serialized PR plans against the main apply so plan
stops reading torn state, and one rewrote the operator docs to frame local
`terraform apply` as break-glass rather than the normal path.

## Why it could be interesting

A documented manual path is a used manual path, and every use of it puts
state outside the system that's supposed to own it. Demoting the manual
path to break-glass isn't a docs change — it's the moment the automated
path becomes the only place authority lives, and it only holds if the
automated path is actually serialized against itself.

## Open questions

- [ ] What forced the reframing — did local apply cause a real drift or
torn-state incident, or was it noticed while fixing the concurrency
race?
- [ ] Is break-glass enforced by anything, or is it convention? (A sensor
would be: applies from outside CI are detectable.)
- [ ] Does the same demotion apply elsewhere in the fleet — manual
Hackage uploads, hand-created labels, console edits?
- [ ] How does this relate to the wider governance move (labels, tag
rulesets, required checks all landing in the baseline module)?

## Source material

- — operator docs describe apply as manual; CI applies on main with local as fallback
- — frame local apply as break-glass, not the norm
- — PR terraform-plan no longer reads torn state during a concurrent main apply
- — serialize PR plans against the main apply
- — repository labels are Terraform-managed rather than hand-created
- — release tags immutable under a tag ruleset in the baseline module
- — alunduil-chezmoi requires its consolidated CI checks before merging
- Adjacent open ideas: #100 (Living in Terraform), #72 (importing repos via a Claude skill)