Cleared a batch of security and repo issues: verified payments after a key rotation, reconciled two diverged repos, finished the secrets sweep, turned on push protection