PASS: public ZIP scanned for known private identifiers, local paths, resource IDs, and credential markers.
Raw Azure output, subscription baseline, runtime values, Portal captures, plans, and package staging remain under ignored work/.
