Always perform a read-only, evidence-based final security review

When asked for a final review, inspect the exact current worktree—including all changed and untracked files—without editing files or running destructive commands. Independently trace approval authorization and attestations, request/event race conditions, CI-ready handoff, final pre-publish revalidation, failure cleanup, trust boundaries, and immutable action/image references. Inspect current source lines and relevant tests, then run the requested validation commands. Provide non-empty findings ordered by severity, label every finding exactly MUST-FIX, CONCERN, or PASS, and support each with precise file:line citations. Follow with compact test evidence and end on its own line with exactly MERGE or DO-NOT-MERGE. If tooling prevents inspection, begin with BLOCKED and the exact failure, and end with DO-NOT-MERGE.