Catalog access is now provisioned with a dedicated Contents read/write token scoped only to the private data repository. Document its expiry and keep the public workflow ready for activation.

The verification-only job now reserves its actual 15-minute timeout instead of the refresh job's 27-minute budget. Full refresh/checkpoint protection and the 22:00–02:00 UTC exclusion remain unchanged.

Validation: deterministic checks cover before 02:00, exactly 02:00, 21:44, exactly 21:45, immediately after 21:45, and 22:00. GitHub confirms the encrypted secret exists; no token value is committed or logged. After merge, run private-producer verification before the first scheduled refresh with configured OpenAI/Jev enrichment.