diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 8f90d6bea6..7eac107209 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -64,21 +64,6 @@
       matchDepNames: ['rust'],
       enabled: false,
     },
-    // setup-just v4 runs extractions/setup-crate, which the org's Actions
-    // allowlist does not include, so every job using it fails at setup.
-    {
-      matchManagers: ['github-actions'],
-      matchDepNames: ['extractions/setup-just'],
-      allowedVersions: '<4',
-    },
-    // setup-rust-toolchain v2 sets CARGO_BUILD_WARNINGS=deny, so cargo's
-    // unused-dependency manifest warnings fail every build. Stay on v1 until
-    // those dependencies are cleaned up.
-    {
-      matchManagers: ['github-actions'],
-      matchDepNames: ['actions-rust-lang/setup-rust-toolchain'],
-      allowedVersions: '<2',
-    },
 
     // Patch-only catch-all. Not minor: most crates here are 0.x, where a
     // "minor" is a breaking change and deserves its own PR.
diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index fad7abddc1..85fbafbefe 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -1,28 +1,40 @@
-# Security audit workflow
+# Security audit workflow: RustSec advisories and cargo-deny policy, on any
+# change to the dependency graph or the audit config.
 name: Security Audit
 
 on:
   push:
-    branches: [main]
+    branches: [unity/hub-consolidated, unity/hub-4.0]
     paths:
       - '**/Cargo.toml'
       - '**/Cargo.lock'
+      - audit.toml
+      - deny.toml
+      - .github/workflows/audit.yml
   pull_request:
     paths:
       - '**/Cargo.toml'
       - '**/Cargo.lock'
-  schedule:
-    - cron: '0 0 * * 1'
+      - audit.toml
+      - deny.toml
+      - .github/workflows/audit.yml
   workflow_dispatch:
 
 permissions:
   contents: read
-  checks: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   # cargo-audit: vulnerability scanning (advisory DB)
   cargo-audit:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      checks: write
     steps:
       - uses: actions/checkout@v7
       - uses: rustsec/audit-check@v2
@@ -33,6 +45,7 @@ jobs:
   # cargo-deny: license compliance + advisory + duplicate detection
   cargo-deny:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
       - uses: EmbarkStudios/cargo-deny-action@v2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1184af369f..d931c0de65 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,93 +1,114 @@
-# Main CI workflow
+# Main CI workflow for Unity's fork. Branch protection requires one check,
+# `CI Required`, which fails if any job below failed or was skipped when it
+# should have run.
 name: CI
 
-permissions:
-  contents: read
-
 on:
+  # Pushes to the protected Unity branches seed the Rust caches that pull
+  # requests restore. `main` only mirrors upstream, so it runs nothing.
   push:
-    branches: [main, "v[0-9]+.[0-9]+.x"]
+    branches: [unity/hub-consolidated, unity/hub-4.0]
   pull_request:
-    branches: ["**"]
+  workflow_dispatch:
 
+permissions:
+  contents: read
+
+# A new push to a pull request cancels its older run. Branch pushes each keep
+# their own run.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.ref_name == 'main' && github.sha || 'anysha' }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
   CARGO_INCREMENTAL: 0
+  # setup-rust-toolchain v2 defaults this to `deny`, which also fails the build
+  # on cargo 1.100's manifest lints (unused dependencies, missing `[lints]`) in
+  # upstream crates. Jobs that compile pass `rustflags: -D warnings` instead,
+  # as v1 did, so rustc warnings still fail on every platform.
+  CARGO_BUILD_WARNINGS: warn
+  # Only branch pushes save Rust caches. Each PR saving its own ~1 GB entry
+  # filled the 10 GB repo budget, and no other PR could read them anyway.
+  SAVE_RUST_CACHE: ${{ github.event_name == 'push' }}
 
 jobs:
-  # Change detection
+  # Decides whether the Rust jobs run. A pull request skips them only when
+  # every file it changes is documentation or repo metadata. A change to CI
+  # itself (this file, the justfile, toolchain config) runs everything.
   orchestrate:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
-      run_tests: ${{ steps.filter.outputs.run_tests }}
-      run_style: ${{ steps.filter.outputs.run_style }}
+      rust: ${{ steps.filter.outputs.rust }}
     steps:
       - uses: actions/checkout@v7
         with:
-          fetch-depth: ${{ github.ref == 'refs/heads/main' && 2 || 350 }}
+          # The PR merge commit's first parent is the base branch tip.
+          fetch-depth: 2
       - id: filter
+        env:
+          EVENT: ${{ github.event_name }}
         run: |
-          if [ -z "$GITHUB_BASE_REF" ]; then
-            COMPARE_REV="$(git rev-parse HEAD~1)"
+          if [ "$EVENT" != "pull_request" ]; then
+            echo "rust=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          CHANGED="$(git diff --name-only HEAD^1 HEAD)"
+          echo "$CHANGED"
+          DOCS_ONLY='^(docs/|[^/]+\.md$|\.github/(CODEOWNERS|PULL_REQUEST_TEMPLATE\.md|DISCUSSION_TEMPLATE/|renovate\.json5$|VOUCHED\.td$|issue-unvouched-message$|llmgenerated-response-message$|workflows/audit\.yml$)|renovate\.json$)'
+          if echo "$CHANGED" | grep -qvE "$DOCS_ONLY"; then
+            echo "rust=true" >> "$GITHUB_OUTPUT"
           else
-            git fetch --update-head-ok origin "$GITHUB_BASE_REF" --depth=350 || true
-            COMPARE_REV="$(git merge-base "origin/${GITHUB_BASE_REF}" HEAD)"
+            echo "rust=false" >> "$GITHUB_OUTPUT"
           fi
-          CHANGED_FILES="$(git diff --name-only "$COMPARE_REV" "$GITHUB_SHA")"
-
-          check_pattern() {
-            local name="$1" pattern="$2" invert="${3:-false}"
-            if [ "$invert" = "true" ]; then
-              echo "$CHANGED_FILES" | grep -qvE "$pattern" && echo "${name}=true" >> "$GITHUB_OUTPUT" || echo "${name}=false" >> "$GITHUB_OUTPUT"
-            else
-              echo "$CHANGED_FILES" | grep -qE  "$pattern" && echo "${name}=true" >> "$GITHUB_OUTPUT" || echo "${name}=false" >> "$GITHUB_OUTPUT"
-            fi
-          }
-
-          check_pattern "run_tests" '^(docs/|\.github/(ISSUE_TEMPLATE|workflows/)|README\.md|CHANGELOG\.md)' true
-          check_pattern "run_style" '\.(rs|toml)$|rust-toolchain\.toml|\.cargo/|clippy\.toml|typos\.toml'
 
   # Formatting
   fmt:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: [orchestrate]
-    if: needs.orchestrate.outputs.run_style == 'true'
+    if: needs.orchestrate.outputs.rust == 'true'
     steps:
       - uses: actions/checkout@v7
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           components: rustfmt
+          cache: false
       - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: just
       - run: just fmt-check
 
-  # Clippy
+  # Clippy. `just clippy` passes `-D warnings` itself.
   clippy:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: [orchestrate]
-    if: needs.orchestrate.outputs.run_style == 'true'
+    if: needs.orchestrate.outputs.rust == 'true'
     steps:
       - uses: actions/checkout@v7
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           components: clippy
-      - uses: Swatinem/rust-cache@v2
+          cache-save-if: ${{ env.SAVE_RUST_CACHE }}
+          rustflags: -D warnings
       - name: Install system deps
         run: |
           sudo apt-get update
           sudo apt-get install -y libxkbcommon-dev libxkbcommon-x11-dev libwayland-dev libx11-dev libxcb-shape0-dev libxcb-xfixes0-dev libfontconfig-dev
       - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: just
       - run: just clippy
 
   # Spell check
   typos:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v7
       - uses: crate-ci/typos@v1.52.1
@@ -98,9 +119,12 @@ jobs:
   # from upstream releases and should be reviewed, not block unrelated work.
   lockfile:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          cache: false
       - name: Check root lockfile freshness (warning only)
         shell: bash
         run: |
@@ -115,61 +139,76 @@ jobs:
             warn "Cargo.lock changed after cargo update; refresh it in a dedicated dependency update."
           fi
 
-  # Unused dependencies
+  # Unused dependencies. cargo-machete reads sources and builds nothing.
   machete:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: [orchestrate]
-    if: needs.orchestrate.outputs.run_style == 'true'
+    if: needs.orchestrate.outputs.rust == 'true'
     steps:
       - uses: actions/checkout@v7
-      - uses: Swatinem/rust-cache@v2
-      - uses: taiki-e/install-action@cargo-machete
       - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: just,cargo-machete
       - run: just machete
 
-  # MSRV
+  # MSRV. Keep `toolchain:` equal to `rust-version` in crates/gpui/Cargo.toml
+  # and `msrv` in the justfile. .github/renovate.json5 stops Renovate moving it.
   msrv:
-    if: github.event_name == 'pull_request' && needs.orchestrate.outputs.run_style == 'true'
-    needs: [orchestrate]
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    needs: [orchestrate]
+    if: needs.orchestrate.outputs.rust == 'true'
     steps:
       - uses: actions/checkout@v7
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           toolchain: 1.95.0
-      - uses: Swatinem/rust-cache@v2
+          cache-save-if: ${{ env.SAVE_RUST_CACHE }}
+          rustflags: -D warnings
       - name: Install system deps
         run: |
           sudo apt-get update
           sudo apt-get install -y libxkbcommon-dev libxkbcommon-x11-dev libwayland-dev libx11-dev libxcb-shape0-dev libxcb-xfixes0-dev libfontconfig-dev
       - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: just
       - run: just msrv-check
 
   # WASM target (nightly + atomics)
   check-wasm:
-    if: github.event_name == 'pull_request' && needs.orchestrate.outputs.run_style == 'true'
-    needs: [orchestrate]
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    needs: [orchestrate]
+    if: needs.orchestrate.outputs.rust == 'true'
     steps:
       - uses: actions/checkout@v7
-      - name: Install nightly toolchain with rust-src and WASM target
-        run: rustup toolchain install nightly --component rust-src --target wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          toolchain: nightly
+          components: rust-src
+          target: wasm32-unknown-unknown
+          cache-save-if: ${{ env.SAVE_RUST_CACHE }}
       - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: just
       - run: just check-wasm-atomics
 
   # Linux build + test
   test-linux:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     needs: [orchestrate]
-    if: needs.orchestrate.outputs.run_tests == 'true'
+    if: needs.orchestrate.outputs.rust == 'true'
     steps:
       - uses: actions/checkout@v7
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          cache-save-if: ${{ env.SAVE_RUST_CACHE }}
+          rustflags: -D warnings
       - name: Install system deps
         run: |
           sudo apt-get update
@@ -180,7 +219,9 @@ jobs:
             libxkbcommon-x11-dev libegl1-mesa-dev \
             libgles2-mesa-dev libglib2.0-dev libfontconfig-dev
       - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: just
       - run: just build
       - run: just test
       - run: just test-doc
@@ -192,14 +233,19 @@ jobs:
   # macOS build + test
   test-mac:
     runs-on: macos-latest
+    timeout-minutes: 45
     needs: [orchestrate]
-    if: needs.orchestrate.outputs.run_tests == 'true'
+    if: needs.orchestrate.outputs.rust == 'true'
     steps:
       - uses: actions/checkout@v7
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          cache-save-if: ${{ env.SAVE_RUST_CACHE }}
+          rustflags: -D warnings
       - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: just
       - run: just build
       - run: just test --features gpui_ce_wgpu/test-support
       - run: just test-doc
@@ -211,14 +257,19 @@ jobs:
   # Windows build + test
   test-windows:
     runs-on: windows-latest
+    timeout-minutes: 60
     needs: [orchestrate]
-    if: needs.orchestrate.outputs.run_tests == 'true'
+    if: needs.orchestrate.outputs.rust == 'true'
     steps:
       - uses: actions/checkout@v7
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          cache-save-if: ${{ env.SAVE_RUST_CACHE }}
+          rustflags: -D warnings
       - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: just
       - run: just build
       - run: just test
       - run: just test-doc
@@ -230,18 +281,58 @@ jobs:
   # Examples
   check-examples:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: [orchestrate]
-    if: github.event_name == 'pull_request' && needs.orchestrate.outputs.run_tests == 'true'
+    if: needs.orchestrate.outputs.rust == 'true'
     steps:
       - uses: actions/checkout@v7
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          target: wasm32-unknown-unknown
+          cache-save-if: ${{ env.SAVE_RUST_CACHE }}
+          rustflags: -D warnings
       - name: Install system deps
         run: |
           sudo apt-get update
           sudo apt-get install -y libxkbcommon-dev libxkbcommon-x11-dev libwayland-dev libx11-dev libxcb-shape0-dev libxcb-xfixes0-dev libfontconfig-dev
-      - name: Add WASM target
-        run: rustup target add wasm32-unknown-unknown
       - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: just
       - run: just check-examples
+
+  # The one check branch protection requires. Job names can change without
+  # touching the ruleset. A skipped job passes only when `orchestrate` chose to
+  # skip the Rust jobs; a Rust job that should have run and didn't fails it.
+  ci-required:
+    name: CI Required
+    if: always()
+    needs:
+      - orchestrate
+      - fmt
+      - clippy
+      - typos
+      - lockfile
+      - machete
+      - msrv
+      - check-wasm
+      - test-linux
+      - test-mac
+      - test-windows
+      - check-examples
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - env:
+          NEEDS: ${{ toJSON(needs) }}
+          RUST: ${{ needs.orchestrate.outputs.rust }}
+        run: |
+          echo "$NEEDS" | jq -r 'to_entries[] | "\(.key): \(.value.result)"'
+          allowed='["success"]'
+          if [ "$RUST" = "false" ]; then allowed='["success","skipped"]'; fi
+          bad="$(echo "$NEEDS" | jq -r --argjson ok "$allowed" \
+            '[to_entries[] | select(.value.result as $r | $ok | index($r) | not) | .key] | join(", ")')"
+          if [ -n "$bad" ]; then
+            echo "::error title=CI Required::Not successful: $bad"
+            exit 1
+          fi
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
deleted file mode 100644
index fb57683e96..0000000000
--- a/.github/workflows/prerelease.yml
+++ /dev/null
@@ -1,87 +0,0 @@
-# Publish the development snapshots for the next committed gpui-ce release.
-# Every publishable workspace crate is published at the same crates.io-only
-# version, in dependency order. No alpha tag or alpha-version commit is created
-# in this repository.
-name: Publish prerelease
-
-on:
-  workflow_run:
-    workflows: [CI]
-    types: [completed]
-
-concurrency:
-  # crates.io versions are IMMUTABLE, so alpha numbers must be allocated in
-  # order even when main receives several commits in quick succession!
-  group: gpui-ce-registry-publish
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-
-env:
-  CARGO_TERM_COLOR: always
-  RUST_BACKTRACE: 1
-
-jobs:
-  version:
-    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main'
-    runs-on: ubuntu-latest
-    outputs:
-      publish: ${{ steps.version.outputs.publish }}
-      version: ${{ steps.version.outputs.version }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event.workflow_run.head_sha }}
-          fetch-depth: 0
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
-      - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v2
-      - id: version
-        name: Allocate the next crates.io alpha version
-        run: just alpha-version "$HEAD_SHA"
-        env:
-          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
-
-  publish:
-    needs: version
-    if: needs.version.outputs.publish == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event.workflow_run.head_sha }}
-          fetch-depth: 0
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
-      - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v2
-      - name: Publish every crate in dependency order
-        run: just alpha-publish "$VERSION" "$HEAD_SHA"
-        env:
-          VERSION: ${{ needs.version.outputs.version }}
-          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-
-  smoke:
-    # Prove the published set resolves and compiles for a consumer.
-    needs: [version, publish]
-    if: needs.version.outputs.publish == 'true' && needs.publish.result == 'success'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ github.event.workflow_run.head_sha }}
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
-      - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v2
-      - name: Install package build dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            libxkbcommon-dev libwayland-dev libx11-dev \
-            libxcb-shape0-dev libxcb-xfixes0-dev libxcb-randr0-dev \
-            libxcb-xinput-dev libxkbcommon-x11-dev libfontconfig-dev
-      - name: Compile a fresh consumer crate against the snapshot
-        run: just alpha-smoke "$VERSION"
-        env:
-          VERSION: ${{ needs.version.outputs.version }}
diff --git a/.github/workflows/release-pr-check.yml b/.github/workflows/release-pr-check.yml
deleted file mode 100644
index c2789ba4ba..0000000000
--- a/.github/workflows/release-pr-check.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: Release check
-
-on:
-  pull_request:
-    branches: [main]
-    types: [opened, synchronize, reopened, labeled, unlabeled]
-
-permissions:
-  contents: read
-
-jobs:
-  check:
-    # Release PRs are identified by their branch, matching `just release-pr-open`
-    if: startsWith(github.head_ref, 'release/v') && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
-    env:
-      HEAD_REF: ${{ github.head_ref }}
-      LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
-      - uses: Swatinem/rust-cache@v2
-      - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v4
-      - name: Branch, label and version agree
-        run: just release-pr-check "$HEAD_REF" "$LABELS"
-      - name: Changelog, lockstep versions and crates.io availability
-        run: just release-check true
-      - name: Dry-run publish of the whole crate graph
-        run: just publish true
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
deleted file mode 100644
index f34571cae7..0000000000
--- a/.github/workflows/release-pr.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: Prepare release PR
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Version to release, stable MAJOR.MINOR.PATCH (e.g. 0.4.0)'
-        required: true
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  prepare:
-    runs-on: ubuntu-latest
-    env:
-      VERSION: ${{ inputs.version }}
-      # Pull requests opened with the default GITHUB_TOKEN do not trigger CI.
-      # Provide a PAT or GitHub App token as RELEASE_PR_TOKEN so the required
-      # checks run on the release PR (see MAINTENANCE.md).
-      GH_TOKEN: ${{ secrets.RELEASE_PR_TOKEN || secrets.GITHUB_TOKEN }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          token: ${{ secrets.RELEASE_PR_TOKEN || secrets.GITHUB_TOKEN }}
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
-      - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v4
-      - run: just release-pr-open "$VERSION"
diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
deleted file mode 100644
index 1c23395b30..0000000000
--- a/.github/workflows/release-tag.yml
+++ /dev/null
@@ -1,45 +0,0 @@
-name: Tag release
-
-on:
-  push:
-    branches: [main]
-    # A release PR always rolls the CHANGELOG
-    paths: [CHANGELOG.md, crates/gpui/Cargo.toml]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: gpui-ce-release-tag
-  cancel-in-progress: false
-
-jobs:
-  tag:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: read
-    outputs:
-      tag: ${{ steps.detect.outputs.tag }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
-      - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v4
-      - id: detect
-        name: Tag if this push is a merged release PR
-        run: just release-tag
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-  release:
-    needs: tag
-    if: needs.tag.outputs.tag != ''
-    uses: ./.github/workflows/release.yml
-    with:
-      tag: ${{ needs.tag.outputs.tag }}
-    secrets: inherit
-    permissions:
-      contents: write
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index 2ab40862da..0000000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,135 +0,0 @@
-# Publish to crates on a version tag push, or when release-tag.yml calls it
-# after a release PR merges (tags pushed with GITHUB_TOKEN trigger no workflows,
-# so that path calls this one directly instead of relying on the tag push).
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_call:
-    inputs:
-      tag:
-        description: 'Tag to release, e.g. v0.4.0'
-        required: true
-        type: string
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Dry run (no actual publish)'
-        required: false
-        default: 'false'
-
-env:
-  CARGO_TERM_COLOR: always
-  RUST_BACKTRACE: 1
-  RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
-
-# Stable and alpha uploads share a registry namespace. Do not let a stable tag
-# overtake an alpha allocation (or vice versa).
-concurrency:
-  group: gpui-ce-registry-publish
-  cancel-in-progress: false
-
-jobs:
-  # Determine pre-release status
-  prerelease:
-    runs-on: ubuntu-latest
-    outputs:
-      value:   ${{ steps.check.outputs.value }}
-      version: ${{ steps.check.outputs.version }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ env.RELEASE_TAG }}
-      - id: check
-        run: |
-          VERSION="${RELEASE_TAG#v}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          if [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "value=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "value=true"  >> "$GITHUB_OUTPUT"
-          fi
-
-  # Run full CI on the tag via justfile
-  verify:
-    needs: [prerelease]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ env.RELEASE_TAG }}
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
-        with:
-          components: clippy, rustfmt
-      - uses: Swatinem/rust-cache@v2
-      - name: Install system deps
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            libxkbcommon-dev libwayland-dev libx11-dev \
-            libxcb-shape0-dev libxcb-xfixes0-dev \
-            libxcb-randr0-dev libxcb-xinput-dev \
-            libxkbcommon-x11-dev libegl1-mesa-dev \
-            libgles2-mesa-dev libglib2.0-dev libfontconfig-dev \
-            libgtk-3-dev \
-            libjavascriptcoregtk-4.1-dev libwebkit2gtk-4.1-dev \
-            libsoup-3.0-dev
-      - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v4
-      - run: just fmt-check
-      - run: just clippy
-      - run: just build
-      - run: just test
-      - run: just test-doc
-
-  # Verify packages are publishable
-  verify-publish:
-    needs: [prerelease, verify]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ env.RELEASE_TAG }}
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
-      - uses: Swatinem/rust-cache@v2
-      - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v4
-      - name: Dry-run publish check
-        run: just publish true
-
-  # Publish to crates.io
-  publish:
-    needs: [prerelease, verify-publish]
-    runs-on: ubuntu-latest
-    if: github.event_name != 'workflow_dispatch' || github.event.inputs.dry_run != 'true'
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ env.RELEASE_TAG }}
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
-      - uses: Swatinem/rust-cache@v2
-      - uses: hustcer/setup-nu@v3
-      - uses: extractions/setup-just@v4
-      - run: just publish
-        env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-
-  # Create GitHub Release
-  github-release:
-    needs: [prerelease, publish]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: ${{ env.RELEASE_TAG }}
-      - uses: softprops/action-gh-release@v3
-        with:
-          tag_name: ${{ env.RELEASE_TAG }}
-          draft: true
-          prerelease: ${{ needs.prerelease.outputs.value }}
-          generate_release_notes: true
-          name: ${{ needs.prerelease.outputs.version }}
diff --git a/.github/workflows/vouch-check-issue.yml b/.github/workflows/vouch-check-issue.yml
deleted file mode 100644
index 7d21822b8d..0000000000
--- a/.github/workflows/vouch-check-issue.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-on:
-  issues:
-    types: [opened, reopened]
-
-name: "Vouch - Check Issue"
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      # acquire a token that allows vouch actions to mutate repository
-      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        id: app-token
-        with:
-          client-id: ${{ vars.VOUCH_CLIENT_ID }}
-          private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }}
-
-      # grab the unvounched message file from the repository, so it can be used by the bot
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          sparse-checkout: .github/issue-unvouched-message
-
-      # bot checks the issue; if unvounched then add a comment and close+lock the issue
-      - uses: gpui-ce/vouch/action/check-issue@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0
-        with:
-          issue-number: ${{ github.event.issue.number }}
-          auto-close: true
-          auto-lock: true
-          template-file: .github/issue-unvouched-message
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/vouch-check-pr.yml b/.github/workflows/vouch-check-pr.yml
deleted file mode 100644
index 72be6bbb79..0000000000
--- a/.github/workflows/vouch-check-pr.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-on:
-  pull_request_target:
-    types: [opened, reopened]
-
-name: "Vouch - Check PR"
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      # acquire a token that allows vouch actions to mutate repository
-      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        id: app-token
-        with:
-          client-id: ${{ vars.VOUCH_CLIENT_ID }}
-          private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }}
-
-      # grab the unvounched message file from the repository, so it can be used by the bot
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          sparse-checkout: .github/issue-unvouched-message
-
-      # bot checks the PR; if unvounched then close the PR
-      - uses: gpui-ce/vouch/action/check-pr@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0
-        with:
-          pr-number: ${{ github.event.pull_request.number }}
-          auto-close: true
-          template-file: .github/issue-unvouched-message
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/vouch-manage-by-discussion.yml b/.github/workflows/vouch-manage-by-discussion.yml
deleted file mode 100644
index 5a7ee08dbf..0000000000
--- a/.github/workflows/vouch-manage-by-discussion.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-on:
-  discussion_comment:
-    types: [created]
-
-name: "Vouch - Manage by Discussion"
-
-concurrency:
-  group: vouch-manage
-  cancel-in-progress: false
-
-jobs:
-  manage:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        id: app-token
-        with:
-          client-id: ${{ vars.VOUCH_CLIENT_ID }}
-          private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }}
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-
-      - uses: gpui-ce/vouch/action/manage-by-discussion@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0
-        with:
-          discussion-number: ${{ github.event.discussion.number }}
-          comment-node-id: ${{ github.event.comment.node_id }}
-          vouch-keyword: "!vouch"
-          denounce-keyword: "!denounce"
-          unvouch-keyword: "!unvouch"
-          pull-request: "true"
-          merge-immediately: "true"
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/vouch-manage-by-issue.yml b/.github/workflows/vouch-manage-by-issue.yml
deleted file mode 100644
index b57966e9ec..0000000000
--- a/.github/workflows/vouch-manage-by-issue.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-on:
-  issue_comment:
-    types: [created]
-
-name: "Vouch - Manage by Issue"
-
-concurrency:
-  group: vouch-manage
-  cancel-in-progress: false
-
-jobs:
-  manage:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        id: app-token
-        with:
-          client-id: ${{ vars.VOUCH_CLIENT_ID }}
-          private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }}
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-
-      - uses: gpui-ce/vouch/action/manage-by-issue@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0
-        with:
-          repo: ${{ github.repository }}
-          issue-id: ${{ github.event.issue.number }}
-          comment-id: ${{ github.event.comment.id }}
-          vouch-keyword: "!vouch"
-          denounce-keyword: "!denounce"
-          unvouch-keyword: "!unvouch"
-          pull-request: "true"
-          merge-immediately: "true"
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}