Convert .map_err Internal(anyhow!) to ResultExt::context, fix variant misuse
Per-repo HMAC for build hooks, pinned SSH keys, archive scan opt
Restructure into monorepo