Q3 ruling 2026-09-04: Tier 2 of the t/325 ladder is mechanical. Prod- target remote.sh/remote-dns.sh invocations block without a filed GLPI Change id; dev lanes (sectestbed/preprod/test/tsys5/sandbox/kali) exempt; CR tooling exempt (chicken-and-egg). 7-case matrix green, shellcheck clean. https://projects.knownelement.com/issues/767#note-4191