Rewrite README + DEPLOY-R720 for the clean-clone mirror model, the read-only GH_TOKEN PAT recipe, the global hook installer, and the no-CI-by-design decision.
checkov: high-signal exposure/access checks -> high, best-practice noise -> low (was 51 undifferentiated mediums). npm audit wired for Node dep CVEs. Report collapses the low/info tail to a count. Adds ci/security-review.yml (PR backstop) and DEPLOY-R720.md (Phase 3 host runbook).
