alignfirst-setup-guide

No direct malicious payloads, obfuscation, hardcoded secrets, or explicit data exfiltration are visible in this module. The primary security concern is supply-chain/automation risk: the code runs npm install/build/migrate/seed and docker compose operations in a prepared worktree (which will execute whatever scripts/dependencies exist there), and it opens a frontend dev tunnel via helper functions not shown here (potential external exposure). Review/lock down the repository/worktree provenance and audit the tunnel helper implementations to reduce risk.