## Summary

- what changed
- why it changed
- risk and rollback notes

## Checklist

- [ ] No real secrets or credentials committed
- [ ] Server-side scripts validated (`bash -n`)
- [ ] PowerShell scripts validated (`Invoke-ScriptAnalyzer`)
- [ ] Docs updated (full paths and runbook steps)
- [ ] Rollback steps documented