diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100755
index fe6809b..0000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,217 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main, master]
-  pull_request:
-    branches: [main, master]
-
-jobs:
-  build-and-test:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest]
-
-    runs-on: ${{ matrix.os }}
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            vestibule/helper/target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('vestibule/helper/Cargo.lock') }}
-          restore-keys: ${{ runner.os }}-cargo-
-
-      - name: Build usher
-        working-directory: vestibule/helper
-        run: cargo build --release
-
-      - name: Smoke test (Linux)
-        if: runner.os == 'Linux'
-        working-directory: vestibule
-        run: python3 scripts/test-native-messaging.py
-
-      - name: Smoke test (Windows)
-        if: runner.os == 'Windows'
-        working-directory: vestibule
-        run: python scripts\test-native-messaging.py
-
-      - name: Validate JSON
-        working-directory: vestibule
-        run: |
-          python3 -c "import json; json.load(open('extension/manifest.json'))"
-          python3 -c "import json; json.load(open('config/policies.json'))"
-          python3 -c "import json; json.load(open('config/com.vestibule.usher.linux.json'))"
-          python3 -c "import json; json.load(open('config/com.vestibule.usher.windows.json'))"
-          python3 -c "import json; json.load(open('packaging/net.dcos.Vestibule.json'))"
-
-      - name: Validate XML + icon assets
-        working-directory: vestibule
-        run: |
-          python3 -c "import xml.dom.minidom; xml.dom.minidom.parse('packaging/net.dcos.Vestibule.metainfo.xml')"
-          python3 - <<'EOF'
-          import os
-          for f in ["packaging/icons/vestibule.ico", "packaging/icons/vestibule.svg"]:
-              assert os.path.exists(f) and os.path.getsize(f) > 0, f
-          print("icon assets ok")
-          EOF
-
-      - name: Check JS syntax
-        working-directory: vestibule/extension
-        run: |
-          for f in *.js; do node --check "$f" || exit 1; done
-
-      - name: URL policy unit tests
-        working-directory: vestibule
-        run: node scripts/test-url-policy.js
-
-      - name: Check POSIX sh syntax
-        if: runner.os == 'Linux'
-        working-directory: vestibule/scripts
-        run: |
-          for f in *.sh vestibule-kiosk-launch; do sh -n "$f" || exit 1; done
-          sh -n ../packaging/vestibule-flatpak-cli
-          sh -n ../packaging/build-flatpak.sh
-
-      - name: Check PowerShell syntax
-        if: runner.os == 'Linux'
-        working-directory: vestibule
-        shell: pwsh
-        run: |
-          $files = Get-ChildItem scripts/*.ps1, packaging/*.ps1
-          foreach ($f in $files) {
-            $errs = $null
-            [void][System.Management.Automation.Language.Parser]::ParseFile($f.FullName, [ref]$null, [ref]$errs)
-            if ($errs) {
-              $errs | ForEach-Object { Write-Error "$($f.Name): $($_.Message)" }
-              exit 1
-            }
-          }
-          Write-Host "PowerShell syntax OK ($($files.Count) files)"
-
-      - name: Provision/deprovision integration test (rootless sandbox)
-        if: runner.os == 'Linux'
-        working-directory: vestibule
-        run: sh scripts/test-provision-linux.sh
-
-      - name: provision --check fails with documented exit code (no prereqs on runner)
-        if: runner.os == 'Linux'
-        working-directory: vestibule
-        run: |
-          code=0
-          sh scripts/provision-kiosk.sh --check || code=$?
-          # The runner has systemd but no cage/LibreWolf -> documented exit 3.
-          if [ "$code" -ne 3 ]; then
-            echo "expected exit 3 (missing prerequisites), got $code"
-            exit 1
-          fi
-          echo "check mode returned documented exit code 3"
-
-      - name: provision-kiosk.ps1 -Check fails fast off-Windows (exit 2)
-        if: runner.os == 'Linux'
-        working-directory: vestibule
-        shell: pwsh
-        run: |
-          $code = 0
-          try { & pwsh -NoProfile -File scripts/provision-kiosk.ps1 -Check } catch { $code = 1 }
-          if ($LASTEXITCODE -ne 2) {
-            Write-Error "expected exit 2 (unsupported platform), got $LASTEXITCODE"
-            exit 1
-          }
-          Write-Host "Windows provisioner correctly refuses to run on Linux (exit 2)"
-
-  package-windows:
-    runs-on: windows-latest
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            vestibule/helper/target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('vestibule/helper/Cargo.lock') }}
-          restore-keys: ${{ runner.os }}-cargo-
-
-      - name: Install Inno Setup
-        shell: powershell
-        run: choco install innosetup -y --no-progress
-
-      - name: Build installer + XPI
-        working-directory: vestibule
-        shell: powershell
-        run: |
-          powershell -NoProfile -ExecutionPolicy Bypass -File packaging\build-installer.ps1
-          # Standalone XPI artifact for policy-based manual deploys.
-          Compress-Archive -Path extension\* -DestinationPath vestibule-1.2.2.xpi -Force
-
-      - name: Upload installer artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: vestibule-setup-windows
-          path: |
-            vestibule/packaging/Output/Vestibule-Setup-1.2.2.exe
-            vestibule/vestibule-1.2.2.xpi
-          if-no-files-found: error
-
-  package-linux:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            vestibule/helper/target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('vestibule/helper/Cargo.lock') }}
-          restore-keys: ${{ runner.os }}-cargo-
-
-      - name: Build usher (Linux binary)
-        working-directory: vestibule/helper
-        run: cargo build --release
-
-      - name: Upload usher binary
-        uses: actions/upload-artifact@v4
-        with:
-          name: vestibule-usher-linux
-          path: vestibule/helper/target/release/usher
-          if-no-files-found: error
-
-      - name: Build Flatpak bundle
-        working-directory: vestibule
-        run: |
-          flatpak remote-add --if-not-exists --user flathub https://flathub.org/repo/flathub.flatpakrepo
-          rm -rf packaging/repo packaging/builddir
-          flatpak-builder --user --install-deps-from=flathub --force-clean \
-            --repo=packaging/repo packaging/builddir packaging/net.dcos.Vestibule.json
-          flatpak build-bundle packaging/repo packaging/Vestibule-1.2.2.flatpak \
-            net.dcos.Vestibule 1.2.2
-
-      - name: Upload Flatpak artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: vestibule-flatpak-linux
-          path: vestibule/packaging/Vestibule-1.2.2.flatpak
-          if-no-files-found: error