Cordyceps is less a single bug than a warning label for CI/CD: a workflow trust failure can reshape what gets built, signed, and shipped.