Perform read-only, evidence-based audits with an explicit merge verdict

Always audit the exact current worktree against the stated base without editing, formatting, staging, stashing, committing, generating, or otherwise mutating repository state. Inspect every changed and untracked file and trace security-critical approval, event/request binding, CI transitions, trusted-code execution, immutable dependencies, pre-release validation, and terminal cleanup paths. Treat event and issue data as attacker-controlled while respecting explicitly accepted pre-existing risks. Run requested read-only checks and, when requested, verify the worktree fingerprint is unchanged. Produce a non-empty report with findings ordered by severity, each labeled PASS, CONCERN, or MUST-FIX and supported by current file:line evidence. If tooling blocks review, begin with BLOCKED and quote the exact error. End exactly with MERGE or DO-NOT-MERGE.