- dev/scripts/bootstrap_secrets.py: one-time setup of all secrets
across .env, PostgreSQL, Gitea, and Woodpecker. Includes --verify.
- Remove pull_image:true from harden.yml (Docker Hub 429 rate limit)
- CI pipeline is build+scan+report only — no credential rotation
- Future rotation deferred to P18 milestone