4c1793b9b7
- Failed closed when cloud pulls could not verify the project origin. - Re-verified configuration attribution on every cloud finding detail. - Rejected non-repository-relative Codex bundle locations. - Refused lineage comparisons against incomplete after-scans. - Preserved diff and working-tree targets when adding path scopes. - Logged post-publication output failures and recovered persisted status. - Used Bun.SHA256 directly and reused pi-ai JWT decoding. - Shortened exported paths in interactive output.