diff --git a/.forgejo/workflows/docker-publish.yml b/.forgejo/workflows/docker-publish.yml
deleted file mode 100644
index bed00e7..0000000
--- a/.forgejo/workflows/docker-publish.yml
+++ /dev/null
@@ -1,50 +0,0 @@
-# Reusable Docker build and publish workflow
-# Usage: uses: core/go-devops/.forgejo/workflows/docker-publish.yml@main
-
-name: Docker Publish
-
-on:
-  workflow_call:
-    inputs:
-      image:
-        description: Image name (e.g. host-uk/app)
-        type: string
-        required: true
-      dockerfile:
-        description: Path to Dockerfile
-        type: string
-        default: Dockerfile
-      context:
-        description: Docker build context
-        type: string
-        default: '.'
-      registry:
-        description: Container registry
-        type: string
-        default: dappco.re/osi
-    secrets:
-      REGISTRY_USER:
-        required: true
-      REGISTRY_TOKEN:
-        required: true
-
-jobs:
-  build-push:
-    name: Build & Push
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Login to registry
-        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${{ inputs.registry }} -u ${{ secrets.REGISTRY_USER }} --password-stdin
-
-      - name: Build and push
-        run: |
-          SHA=$(git rev-parse --short HEAD)
-          docker build \
-            -f ${{ inputs.dockerfile }} \
-            -t ${{ inputs.registry }}/${{ inputs.image }}:${SHA} \
-            -t ${{ inputs.registry }}/${{ inputs.image }}:latest \
-            ${{ inputs.context }}
-          docker push ${{ inputs.registry }}/${{ inputs.image }}:${SHA}
-          docker push ${{ inputs.registry }}/${{ inputs.image }}:latest
diff --git a/.forgejo/workflows/go-test.yml b/.forgejo/workflows/go-test.yml
deleted file mode 100644
index 789c628..0000000
--- a/.forgejo/workflows/go-test.yml
+++ /dev/null
@@ -1,45 +0,0 @@
-# Reusable Go test workflow
-# Usage: uses: core/go-devops/.forgejo/workflows/go-test.yml@main
-
-name: Go Test
-
-on:
-  workflow_call:
-    inputs:
-      go-version:
-        description: Go version to use
-        type: string
-        default: '1.26'
-      race:
-        description: Enable race detector
-        type: boolean
-        default: false
-      coverage:
-        description: Generate coverage report
-        type: boolean
-        default: false
-
-jobs:
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ inputs.go-version }}
-
-      - name: Run tests
-        run: |
-          FLAGS="-v"
-          if [ "${{ inputs.race }}" = "true" ]; then
-            FLAGS="$FLAGS -race"
-          fi
-          if [ "${{ inputs.coverage }}" = "true" ]; then
-            FLAGS="$FLAGS -coverprofile=coverage.out"
-          fi
-          go test $FLAGS ./...
-
-      - name: Coverage summary
-        if: inputs.coverage
-        run: go tool cover -func=coverage.out | tail -1
diff --git a/.forgejo/workflows/security-scan.yml b/.forgejo/workflows/security-scan.yml
deleted file mode 100644
index 103c802..0000000
--- a/.forgejo/workflows/security-scan.yml
+++ /dev/null
@@ -1,70 +0,0 @@
-# Reusable security scanning workflow for Go repos
-# Usage: uses: core/go-devops/.forgejo/workflows/security-scan.yml@main
-#
-# Runs: govulncheck, gitleaks, trivy
-
-name: Security Scan
-
-on:
-  workflow_call:
-    inputs:
-      go-version:
-        description: Go version to use
-        type: string
-        default: '1.26'
-      trivy-severity:
-        description: Trivy severity threshold
-        type: string
-        default: 'HIGH,CRITICAL'
-      gitleaks-version:
-        description: Gitleaks version
-        type: string
-        default: '8.24.3'
-
-jobs:
-  govulncheck:
-    name: Go Vulnerability Check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ inputs.go-version }}
-      - name: Install govulncheck
-        run: go install golang.org/x/vuln/cmd/govulncheck@latest
-      - name: Run govulncheck
-        run: govulncheck ./...
-
-  gitleaks:
-    name: Secret Detection
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Install gitleaks
-        run: |
-          set -euo pipefail
-          GITLEAKS_VERSION="${{ inputs.gitleaks-version }}"
-          ARCH=$(uname -m)
-          case "$ARCH" in
-            x86_64)  ARCH_SUFFIX="x64" ;;
-            aarch64) ARCH_SUFFIX="arm64" ;;
-            *)       echo "Unsupported arch: $ARCH"; exit 1 ;;
-          esac
-          URL="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_${ARCH_SUFFIX}.tar.gz"
-          curl -fsSL "$URL" | tar xz -C /usr/local/bin gitleaks
-          gitleaks version
-      - name: Scan for secrets
-        run: gitleaks detect --source . --no-banner
-
-  trivy:
-    name: Dependency & Config Scan
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install Trivy
-        run: |
-          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
-      - name: Filesystem scan
-        run: trivy fs --scanners vuln,secret,misconfig --severity ${{ inputs.trivy-severity }} --exit-code 1 .
diff --git a/.woodpecker/bugseti.yml b/.woodpecker/bugseti.yml
deleted file mode 100644
index 8e8b77a..0000000
--- a/.woodpecker/bugseti.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-when:
-  - event: tag
-    ref: "refs/tags/bugseti-v*"
-  - event: push
-    branch: main
-    path: "cmd/bugseti/**"
-
-steps:
-  - name: frontend
-    image: node:22-bookworm
-    commands:
-      - cd cmd/bugseti/frontend
-      - npm ci --prefer-offline
-      - npm run build
-
-  - name: build-linux
-    image: golang:1.25-bookworm
-    environment:
-      CGO_ENABLED: "1"
-      GOOS: linux
-      GOARCH: amd64
-    commands:
-      - apt-get update -qq && apt-get install -y -qq libgtk-3-dev libwebkit2gtk-4.1-dev > /dev/null 2>&1
-      - cd cmd/bugseti
-      - go build -tags production -trimpath -buildvcs=false -ldflags="-w -s" -o ../../bin/bugseti
-    depends_on: [frontend]
-
-  - name: package
-    image: alpine:3.21
-    commands:
-      - cd bin
-      - tar czf bugseti-linux-amd64.tar.gz bugseti
-      - sha256sum bugseti-linux-amd64.tar.gz > bugseti-linux-amd64.tar.gz.sha256
-      - echo "=== Package ==="
-      - ls -lh bugseti-linux-amd64.*
-      - cat bugseti-linux-amd64.tar.gz.sha256
-    depends_on: [build-linux]
-
-  - name: release
-    image: plugins/gitea-release
-    settings:
-      api_key:
-        from_secret: forgejo_token
-      base_url: https://forge.lthn.io
-      files:
-        - bin/bugseti-linux-amd64.tar.gz
-        - bin/bugseti-linux-amd64.tar.gz.sha256
-      title: ${CI_COMMIT_TAG}
-      note: "BugSETI ${CI_COMMIT_TAG} — Linux amd64 build"
-    when:
-      - event: tag
-    depends_on: [package]
diff --git a/.woodpecker/core.yml b/.woodpecker/core.yml
deleted file mode 100644
index dcab568..0000000
--- a/.woodpecker/core.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-when:
-  - event: [push, pull_request, manual]
-
-steps:
-  - name: build
-    image: golang:1.25-bookworm
-    commands:
-      - go version
-      - go mod download
-      - >-
-        go build
-        -ldflags "-X forge.lthn.ai/core/cli/pkg/cli.AppVersion=ci
-        -X forge.lthn.ai/core/cli/pkg/cli.BuildCommit=${CI_COMMIT_SHA:0:7}
-        -X forge.lthn.ai/core/cli/pkg/cli.BuildDate=$(date -u +%Y%m%d)"
-        -o ./bin/core .
-      - ./bin/core --version
-
-  - name: test
-    image: golang:1.25-bookworm
-    commands:
-      - go test -short -count=1 -timeout 120s ./...