Fix second-review findings: reject dot-segment open redirects, atomic relabel with clearable block marker, check every domain holder before releasing stale claims, live-only label holds, post-commit site teardown on repo delete, separate domain re-check clock
10 files changed+121−64
Rendering diff…