canary

SUSPICIOUS: the core canary monitoring behavior fits the stated purpose, and the install provenance appears same-org and partly verifiable. However, the actual skill footprint is much broader than post-deploy monitoring, including telemetry, artifact sync, repo file modification, and possible git commits through opaque local gstack binaries, so the overall scope is disproportionate and medium risk.