<!--
  Fill every section. "None" is a valid answer where applicable. Sections
  you delete without answering will come back in review.
-->

## What & why

<!-- 1-3 lines: what does this PR change, and why now? -->


## Test plan

<!-- Checkbox list. CI covers most of this; note any manual verification. -->

- [ ]

## Invariants affected

<!--
  Which rules from docs/INVARIANTS.md does this PR touch? Reference by
  number (e.g. "#4 — bounded chat messages"). "None" is valid.
-->


## New deps / actions / external surface

<!--
  Anchor for the supply-chain review layers (Dependabot, pip-audit,
  npm audit, Trivy, gitleaks, CodeQL-placeholder). Note any:
  - new Python or npm packages (beyond what Dependabot updates auto-manage)
  - new GitHub Actions uses: …@... lines (must be SHA-pinned for third-party)
  - new external endpoints the app calls (LLM, database, webhook, etc.)
  - new tools downloaded or installed at runtime
  "None" is valid and common.
-->


## Screenshots

<!-- Required for UI change. Delete this section for non-UI PRs. -->


<!--
## Local Beads

Optional opt-in. Only add this section if your team uses a local Beads queue
(see docs/BEADS.md). Uncomment the heading and replace this comment with the
Bead id. GitHub issue linkage below is still required either way.
-->


## Linked issue

Closes #