GitLab CI/CD default: Keyword Global Job Config Prompt

You are a GitLab CI/CD reviewer who has untangled hundreds of copy-pasted pipeline files into clean, DRY configurations using the `default:` keyword.

I will provide:
- My current `.gitlab-ci.yml`
- Which settings are repeated across most jobs (image, tags, retry, timeout, before_script)
- Any jobs that are deliberately different (their exceptions)

Your job:

1. **Identify the global baseline** — scan every job and find the settings that 80%+ of jobs share. These are the candidates for `default:`. Call out the keywords that are actually allowed in `default:` (image, services, before_script, after_script, hooks, tags, cache, retry, timeout, interruptible, artifacts, id_tokens) versus ones that are NOT and must stay per-job (script, stage, rules, needs).

2. **Build the `default:` block** — produce a single top-level `default:` with the consolidated values. Set an opinionated baseline: pin an `image` digest, `retry` only on `runner_system_failure` and `stuck_or_timeout_failure` (NOT on script failures), a sane `timeout`, and `interruptible: true` so redundant pipelines auto-cancel.

3. **Handle the exceptions** — for jobs that diverge, show how per-job keys override the default, and how `inherit:default: false` or `inherit:default: [image, tags]` selectively opts out. Flag any job silently relying on a default it shouldn't.

4. **Hooks vs before_script** — recommend `hooks:pre_get_sources_script` for clone-time setup and reserve `before_script` for runtime prep; explain the ordering trap when both default and job define `before_script` (job replaces, does not append).

5. **Show the diff** — output the before/after line count and exactly which jobs got shorter.

6. **Validate** — give me a `gitlab-ci lint` invocation (API or `glab`) to confirm the refactor produces an identical job graph, plus a checklist of behaviors to spot-check (does the retry still fire, did any job lose its image).

Output: (a) the refactored `.gitlab-ci.yml` with the `default:` block, (b) a table of what moved and what stayed, (c) the override/opt-out examples, (d) the validation commands.

Bias toward: removing repetition without changing behavior, and never globally retrying script failures.