The deploy.yml was missing a permissions: block, which means GitHub defaults to read-only access for public repos. This prevents the nested reusable ci.yml (permissions: contents: write) from starting, causing startup_failure. Also adds secrets: inherit to the ci: job so secrets flow through the reusable workflow chain. Agent-Session: fix-e2e-ref-20260617