Why: test-pg only cloned the default branch, so prev_sha and legacy_sha were never built or attested. Evidence: SELF python3 -m unittest tests.test_ci_credentials tests.test_lifecycle_pin (11 tests, exit 0). Impact: the lifecycle suite prints the combination inventory and keeps login and rdm.ping as NOT_RUN. Refs: .task/feature-svc-d3-real-scenarios.md Co-authored-by: Cursor <cursoragent@cursor.com>