Two unrelated production-bug fixes squashed because they came out of
the same live verification pass on console.openova.io 2026-05-04.
1. catalyst-build.yaml deploy job permissions
PR #720 added a `gh workflow run blueprint-release.yaml` dispatch
step at the end of the deploy job to close the bot-deploy-doesn't-
trigger-workflows gap from #712. Step has been failing on every run
since with HTTP 403 "Resource not accessible by integration"
because GITHUB_TOKEN lacks `actions: write` by default.
Result: blueprint-release was never dispatched after PR #722–727
merged; the bp-catalyst-platform OCI artifact stayed on the
pre-fix chart and any Sovereign provisioned afterwards picked up
the buggy chart. Add the missing permission so dispatch succeeds.
2. AuthLayout.tsx vertical centering at small viewport heights
The sign-in / verify cards were mathematically centered at
1440×900 (Δ=0.008px verified via getBoundingClientRect in
Playwright) but founder reports the card sitting at the top of
the screen on real-world viewports. Root cause: the right panel
had `flex flex-1 items-center justify-center` which centers ONLY
if the inner content fits within the viewport — at smaller heights
the form's natural content flow pushed the card off-screen with
no scroll fallback.
Fix: add `items-stretch` to the outer flex (so the right panel
fills full viewport height), `overflow-y-auto` on the right
column (so the card can scroll inside its column when too tall),
and `py-8` padding on the card wrapper (breathing room when
scrolling kicks in). Result: card is vertically centered when
content fits, and stays visible (column-scrollable) when it
doesn't, on every viewport height from 1024×600 up.
Co-authored-by: hatiyildiz <hatiyildiz@openova.io>
9adca8442a