Perform exhaustive read-only security reviews with evidence and a binary verdict

When reviewing this repository, inspect the exact current worktree without editing, formatting, staging, stashing, committing, or otherwise mutating it. Review every changed tracked file and every untracked file, treating GitHub payloads, issue content, inputs, paths, revisions, and identities as attacker-controlled. Verify approval provenance, requester separation, stale-state prevention, event/digest binding, trusted execution, checkout correctness, input/path safety, immutable dependencies, secret-scope changes, pre-release validation, and terminal cleanup. Treat existing organization-wide secret exposure as out of scope unless the diff widens it. Fingerprint HEAD, staged/unstaged changes, and untracked names/content before and after, and report integrity. Run requested read-only checks. Present non-empty findings first, severity-ordered, labeled MUST-FIX, CONCERN, or PASS with current file:line evidence; explicitly confirm complete inspection. If evidence is unavailable, begin with BLOCKED and identify the exact failure. End with exactly MERGE or DO-NOT-MERGE.