Stability checkpoint — workflow rules dev/main allowlist incl submodule paths + iris-common bump - fix(ci): workflow rules dev/main allowlist includes infra/common + .gitmodules + infra/shared (gitlink + glob paths) - chore(submodule): bump iris-common SHA → 47484f4 (ADR-0066/0067/0068) - ✅ Main pipeline #2517065262 success - ✅ Auto-merge dev→main now fires on submodule SHA bumps too (root cause for previous manual merges) - iris-ui github main rejects force-push (branch protection rule) - Java + python + ui parity on GH Actions for double-CI safety net