Merge secfix/authz into secfix/merge

Resolve overlaps with the auth, git and integrations fixes: MergeFix needs write on a
non-archived pull; releases combine archive checks with tag protection; forks pass
both the account and fork policy checks; collaborator and org removal run the fork
revocation sweep and the follower purge; sessionHandleIsLive reads the D1 sessions
table; the legacy webhook envelope uses its own HKDF purpose and tolerates the v2
ciphertext prefix.

taigrrcommitted 10 days agoparent d2694aeparent 286f9785e9039a0fd975b21bfcbfc2bc9ba38c315d3f6d7Browse files