Edition 3.5 — Repo flipped private. Site stayed public.

Repo flipped private. Site stayed public. Shipped: - Repo visibility flipped to PRIVATE (Belkins on GH Pro tier) - Issues, Wiki, Projects, Discussions disabled — attack surface reduced - SECURITY.md committed with vulnerability reporting + ops rules - .gitignore hardened — .pem, .key, .aws/, .kube/, secrets/, .vercel - Vercel fallback config committed — dual-target astro.config.mjs reads…