Pickup notes — 2026-07-13: deploy hardening, doc audits, credential hygiene

Steps 1–10 are live at augment.didi.sh; this session cleared the production-only bugs that only using the deployed app surfaced.