chore: sync staging → main (follow-up: 9 commits since #1913)

.github/workflows/ci.yml

@@ -142,7 +142,8 @@ jobs:
 
               # Strip the package-import prefix so we can match .coverage-allowlist.txt
               # entries written as paths relative to workspace-server/.
-              rel=$(echo "$file" | sed 's|^github.com/Molecule-AI/molecule-monorepo/platform/||')
+              # Handle both module paths: platform/workspace-server/... and platform/...
+              rel=$(echo "$file" | sed 's|^github.com/Molecule-AI/molecule-monorepo/platform/workspace-server/||; s|^github.com/Molecule-AI/molecule-monorepo/platform/||')
 
               if echo "$ALLOWLIST" | grep -qxF "$rel"; then
                 echo "::warning file=workspace-server/$rel::Critical file at ${pct}% coverage (allowlisted, #1823) — fix before expiry."

.gitignore

@@ -117,12 +117,10 @@ backups/
 
 # Cloned-via-manifest dirs — populated locally by scripts/clone-manifest.sh,
 # tracked in their own standalone repos. Never commit to core.
-# org-templates live in Molecule-AI/molecule-ai-org-template-* repos.
+# org-templates live in Molecule-AI/molecule-ai-org-template-* repos
+# (including molecule-dev — no checkin exception).
 # plugins live in Molecule-AI/molecule-ai-plugin-* repos.
-# Exception: molecule-dev is checked in so it doubles as the internal-team
-# seed template (not fetched via clone-manifest).
-/org-templates/*
-!/org-templates/molecule-dev/
+/org-templates/
 /plugins/
 /workspace-configs-templates/
 # Cloned by publish-workspace-server-image.yml so the Dockerfile's