night-watch

SUSPICIOUS rather than benign: the maintenance workflow is coherent and mostly well-scoped, with no explicit credential harvesting or exfiltration, but the undisclosed provenance and behavior of `night-watchman` leave an execution-trust gap. Overall risk is moderate due to autonomous code changes plus an unresolved external agent path, not due to confirmed malicious behavior.