@kody/doctor

Read-only account hygiene: open run errors, job alarm drift, secret host gaps, and plan pressure.