PASS fork fixture: main missing secrets -> 0 requests; head trusted-secret simulation -> 1 request, pull_request header, identical JSON bytes
PASS push: actual curl/HTTP request unchanged
PASS issues: actual curl/HTTP request unchanged
PASS discussion: actual curl/HTTP request unchanged
PASS shell-looking PR text remained inert; body SHA256 5c29e4cf9a1679e89f38533477bae9d6e6fadba791cbd48f222870ad9c8125e9
HEAD afe112ba8729a734a2fd9d4b4eba4bfe12f32646
LIMIT: actual GitHub Actions secrets/trigger and hosted Cursor receiver were not exercised; dummy credentials, loopback receiver only.