Use strict read-only, evidence-backed security audit reports

When reviewing security or correctness, independently inspect the exact current worktree, relevant workflows, source, and tests without editing, formatting, staging, generating, or otherwise mutating repository files. Return a non-empty report that directly addresses every requested audit question. Order substantive findings from highest to lowest severity and label each MUST-FIX, CONCERN, or PASS, citing current file:line evidence and including compact test/evidence details; state explicit PASS evidence when no defect is found. Preserve any requested scope, especially approval provenance, trust boundaries, immutable pinning, lifecycle cleanup, retries, cancellation, and adversarial paths. If inspection is blocked, begin with BLOCKED, quote the exact tool or artifact error, identify what could not be inspected, and conclude negatively. Always end the report exactly with MERGE or DO-NOT-MERGE.