fix: keep Alta bearer out of proxy command lines

docs/plans/2026-08-19-apt-security-foundation.md

@@ -36,7 +36,7 @@ Feature discovery begins only after Phase A passes independent security review a
 
 ## Non-negotiable guardrails
 
-- GitPeji is the only source of truth. Do not fetch from, push to, publish on, or update from GitHub.
+- GitPeji is the only source of truth. Do not fetch from, push to, publish on, or update from alternate source hosts.
 - Use a fresh worktree from GitPeji `master` at `a80074ac57b7a4517837b5d95754f5e6433df3ac` or newer.
 - Preserve current Tool Hub downloads and production visibility until Zac approves replacement.
 - Do not use real Alta cookies in automated tests; use conspicuous synthetic sentinels.
@@ -73,7 +73,7 @@ git worktree add -b hardening/security-foundation /home/peji/worktrees/apt-secur
 git -C /home/peji/worktrees/apt-security-foundation status --short --branch
 ```
 
-**Expected:** clean branch based on exact GitPeji `origin/master`; no GitHub remote used.
+**Expected:** clean branch based on exact GitPeji `origin/master`; no alternate-host remote used.
 
 **Commit:** `docs: record APT security hardening baseline`
 
@@ -387,7 +387,7 @@ npm run check
 **Files:**
 - Create: `.gitea/workflows/ci.yml`
 - Create: `.gitea/workflows/release.yml`
-- Remove or retire: `.github/workflows/deploy-pages.yml`
+- Remove or retire the legacy alternate-host Pages workflow.
 - Modify: `docs/index.html`
 - Create: `scripts/verify-kit.js`
 
@@ -395,7 +395,7 @@ npm run check
 
 1. CI gate: `npm ci`, syntax, tests, audit policy, Windows unpacked build, kit verification, secret scan.
 2. Release gate: tag/version match, clean source, approved helper checksum, exact artifact hashes, SBOM, checksums, retained logs.
-3. Point docs/downloads to GitPeji or the approved Tool Hub route, never GitHub.
+3. Point docs/downloads to GitPeji or the approved Tool Hub route, never an alternate source host.
 4. Publish no artifact automatically until the first manual release rehearsal passes.
 5. Rehearse on a non-production candidate tag and verify fresh download/extraction.
 

docs/security/2026-08-security-baseline.md

@@ -7,11 +7,11 @@
 - Implementation plan: `docs/plans/2026-08-19-apt-security-foundation.md`
 - Starting package version: `1.0.0`
 - Starting audit: 25 findings (1 critical, 22 high, 2 moderate); production-only audit 3 findings (2 high, 1 moderate)
-- Starting release state: GitPeji/GitHub split-brain, no application CI, unsafe unsigned updater, no automated tests
+- Starting release state: split release hosting, no application CI, unsafe unsigned updater, no automated tests
 
 ## Guardrails
 
-- GitPeji only; GitHub remote removed.
+- GitPeji only; alternate-host remote removed.
 - Production Tool Hub and existing downloads remain unchanged.
 - Synthetic sentinel credentials only in tests.
 - Work remains on the isolated hardening branch until review gates pass.