Resolve designer hardening review findings and validate useful dependency fixes

[elkaix]

Follow-up to #45. Revalidate the remaining review findings against main, add targeted regression coverage, and integrate useful dependency updates without bypassing required checks.

The first commit disables persisted checkout credentials and captures read-only verification inputs for reproducible debugging in the network-restricted execution environment. No secrets or Git credentials are included; diagnostic artifacts have one-day retention. Implementation and verification details will be updated before merge.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}