v4.1.1: heavy-job rules accept api source Group access token POSTs to /projects/:id/pipeline create source=api pipelines. This patch adds 'if: $CI_PIPELINE_SOURCE == "api"' to heavy-job-rules in base-build-scratch, instance, and container-build. Backward-compatible: trigger source still accepted. Pivots the cascade pattern from N per-project trigger tokens to a single group access token (TRIGGER at dunn.dev/immutable scope). basef + carmine consumer pin bumps land alongside this.