REPORT — the security watch's pin list (felhom.eu R-1303), 2026-10-26 night

A sibling of REPORT.md (the night session owns it tonight). The full report: felhom.eu REPORT-security-watch-2026-10-26.md.

What changed here: every pin now names where its security notices are published, and a push gate (upstream, --fast) refuses a pin without one. The rule and its reader are shared: felhom.eu scripts/security_watch_inventory.py. Decoys for the gate were red-proved with a reader that reads comment lines.
Why: the nightly security watch (felhom.eu scripts/security_watch.py, CI 03:40 UTC) reads these lines. No runtime change: nothing on a box changes, nothing is released.
First run: see felhom.eu documentation/audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md and rows R-1304 (traefik), R-1305 (the file manager), R-1306 (27 apps).