Twenty-seven CI runs, and not one of them a test

A day spent on the unglamorous half of forking something — security policy, package metadata, branch protection — which turned up the fact that no test had ever run here, that the one workflow which did run belonged to somebody else, and that three things already written down were wrong.