fix(standards): drop Drone template header comments; fix python-lib quality-gate auth

standards/src/templates/drone/python-lib.yaml

@@ -1,21 +1,3 @@
-# Drone standard — Type A: PyPI package
-#
-# Canonical pipeline for internal Python libraries that ship a wheel/sdist to
-# the private index (dagpipe, doc-forge, hexa, mail-intake, mongo-ops,
-# omniread, openapi-first, py-jwt).
-#
-# Two pipelines ship together:
-#   build-and-publish-pypi   — tag-triggered build + quality gate + publish.
-#   backfill-pypi-from-tags  — custom-triggered replay of every git tag that is
-#                              missing from the index (disaster recovery).
-#
-# Secrets (Drone): PIP_REPO_URL, PIP_USERNAME, PIP_PASSWORD.
-# Copy to <repo>/.drone.yml unchanged; the package name and version are read
-# from pyproject.toml, so no per-repo edits are required.
-#
-# Version guard: the tag build fails unless the git tag equals the version in
-# pyproject.toml (see the versioning standard). This stops a tag from looking
-# like a release while silently publishing nothing.
 ---
 kind: pipeline
 type: docker
@@ -67,8 +49,12 @@ steps:
     commands:
       - pip install --upgrade pip build
       - |
-        AUTH_URL="https://${PIP_USERNAME}:${PIP_PASSWORD}@$(echo "${PIP_REPO_URL#*://}" | sed 's:/*$::')/simple"
-        pip install --index-url "$AUTH_URL" --extra-index-url https://pypi.org/simple/ -U ".[dev]" "pydoclint>=0.9.1"
+        if [ -z "$PIP_REPO_URL" ] || [ -z "$PIP_USERNAME" ] || [ -z "$PIP_PASSWORD" ]; then
+          echo "PIP_REPO_URL / PIP_USERNAME / PIP_PASSWORD are not set" >&2
+          exit 1
+        fi
+      - AUTH_URL="https://$PIP_USERNAME:$PIP_PASSWORD@$(echo "$PIP_REPO_URL" | sed -E 's|^[a-zA-Z]+://||; s|/*$||')/simple"
+      - pip install --index-url "$AUTH_URL" --extra-index-url https://pypi.org/simple/ -U ".[dev]" "pydoclint>=0.9.1"
       - echo "Running quality gate..."
       - python -m black --check .
       - python -m ruff check .

standards/src/templates/drone/service-docker.yaml

@@ -1,25 +1,3 @@
-# Drone standard — Type B: Docker deployment
-#
-# Canonical pipeline for a service that builds an image, pushes it to the
-# private registry, and runs it on the Docker host (auth-server).
-#
-#   build-and-deploy-service — fetch the git tag, fail unless it equals the
-#                              repo-root VERSION file, skip if the image already
-#                              exists, run the quality gate, build, push, and
-#                              restart the container.
-#
-# Secrets (Drone): PIP_REPO_URL, PIP_USERNAME, PIP_PASSWORD, REGISTRY_HOST,
-# REGISTRY_USER, REGISTRY_PASS, plus the service's runtime env (for example
-# MONGO_* / JWT_SECRET).
-#
-# Placeholders to set per repo:
-#   <app>            image / container / network name (e.g. auth-server).
-#   aetos/<app>      image repository on the private registry.
-#   <host-port>      published host port; <container-port> the in-image port.
-#   <env-var>        runtime environment variable consumed by the service.
-#
-# Version guard: the tag-triggered pipeline fails unless the git tag equals the
-# repo-root VERSION file (see the versioning standard).
 ---
 kind: pipeline
 type: docker