* fix(ci): background steps are single run steps, so no JavaScript action reads the event payload while the runner rewrites it * test(ci): guard the background slot cap and pin the payload-free allowlist
