[codeandsolder-git-wrangler]

Implements #58 with one scheduled fleet worker on cold-storage (unit templates supplied, deployed after CI). No release-age exemption or automatic merge path.

Scope

• Enumerates every nonarchived GitHub App installation repo and open Renovate PR with pagination.
• Uses only the PR latest commit and completed failed GitHub Actions quarantine or strict-Rust jobs.
• Verifies the only failed step is the existing Cargo quarantine; parses all authoritative crates.io publication timestamps from the actual failed job log. Unknown, corrupt or absent timestamps are never treated as eligible.
• Requires 72+ hours plus 15 minutes margin for every crate. Revalidates PR head, job, and exact commit check states before rerunning the specific failed job.
• Skips stale heads, unrelated CI failures, running jobs and previously rerun attempts. One scheduled controller; bounded 10 reruns per sweep. No sccache bypass and never merges a PR.
• Read-only default CLI and JSON-lines audit logs, with targeted repository overrides for verification.
• Node built-ins only; five offline unit/integration tests including a fake GitHub API and real rerun API invocation fixture; GH Actions runs them in CI.
• Systemd service/timer and deployment documentation use the existing scoped GitHub App credential helper on cold-storage. No new PAT or long-running agent.

Validation

• Acer Node 26 test suite: 5/5 passed; git diff whitespace checks clean.
• After GitHub checks, run read-only live API smoke on cold-storage before installing the service/timer. Initial deploy will use the already-authorized sentinelx identity.

Closes #58 once verified in a real scheduled run. Detailed execution context is in Notion maintenance log.