Version 0.90.11

Every deploy now checks from the outside that the lock in front of the operator pages is still there.

The operator pages and the operator endpoints are locked twice: once in our own code, which tests cover, and once by the edge service in front of the site, which is configuration we do not keep in the codebase. That second layer had been believed since 4 August and never measured, because every deploy probe runs against our own machine. A deploy now knocks on the public address from outside, checks an ordinary public route first so an outage reads as “cannot tell” rather than “locked”, and looks at who answered rather than at the status code. Measured today: both layers are standing.