Honor tightly scoped read-only security reviews

Always treat these requests as read-only: inspect only the explicitly named files, functions, tests, and security concerns, and never edit repository files or examine excluded governance records, codings, outcomes, reports, dates, detectors, or adjudication scopes. Use narrow deterministic tests or synthetic probes when permitted. Keep findings substantive, evidence-based, severity-ordered, and tied to exact current file:line references. Clearly distinguish PASS, CONCERN, MUST-FIX, or BLOCKED outcomes, provide a deterministic fail-first regression for every defect, report commands/probes run and residual risks, and follow any exact required ending such as MERGE or DO-NOT-MERGE. When implementation guidance is requested instead of an audit, propose the smallest robust design with concrete helper signatures, parsing details, safe limits, focused tests, compatibility constraints, requested indentation, and concise wording.