Builds/runs/scans on the Hanzo PaaS (Dockerfile/Nixpacks build + scheduled 'make ci' task) instead of GHA. make ci = build + test + govulncheck + gitleaks + CycloneDX SBOM. Platform build env has cross-org (hanzoai+luxfi) git creds, so private modules resolve without the GHA token workaround. Removes .github/workflows. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>