taigrrSecurity (GIT-A1..A6, A9..A12, AZ-A3): gate fork PR bridging on live author access, fork-of-base heads only, revocation sweep on collaborator/org removal; tag protection on release create/delete and tag creation; compare and PR 'since' reachability; enforce_admins fails closed on unverifiable pushes; RFC 5987 archive names; per-caller LFS transfer limiter; safeDecode; paged hidden-ref cleanup; reach cache generations
f3b9112 ·