[maxdiluca]

New profile folders currently contain incomplete skeletons, and the website's strict Hugo build stops on existing warnings and duplicate author routes. This change prepares approved new profiles for private validation and draft PR review while preserving approved file bytes and existing author URLs.

It includes a disabled automatic receiver and a separate disabled Microsoft-only manual handoff. The manual option freezes the approved Markdown and image, stops at approved-awaiting-manual-validation, and can send a fixed three-attachment task only to the configured approver when separately enabled. The local recipe verifies exact attachment bytes, a clean verified current-main base, and the actual strict private Hugo build before any public upload. Build success, rendered-preview review, consent, publication authority and deployment remain distinct checks.

Three narrow website repairs preserve existing author routes, direct links, People cards and rendered post/publication pages. Read-only checks now run for all PRs targeting main, including profile-only PRs. The write job remains guarded by the bounded enabled repository-dispatch path.

Validation: 54 receiver tests, 9 original definition tests and 9 manual-handoff tests pass in both local and exported installation layouts. Nine additional synthetic recipe control checks pass; their build function was mocked. Actual strict Hugo 0.152.2 extended baseline and synthetic-proposal builds passed against the three-file website repair, preserving 141 author HTML routes and adding only the synthetic route.

The cloud shell remains Off. Both full definitions still require native connector/schema validation, a reviewed stopped installation, exact runtime authorization and a supervised synthetic pilot. The automatic GitHub connector is blocked by the tenant's applicable DLP policy; the manual option has no GitHub or HTTP action and still needs confirmation of its remaining Microsoft connector combination. No real profile transfer or publication has occurred.