scripts: manifest bearer gate lands as manifest_bearer_gate.py (the .gitignore *secret* pattern silently un-tracks any 'secret'-named gate file - the previous commit's gate never made it into git); references updated

documentation/pilot/RUNBOOK-publish-0.81-0.113-2026-07-11.md

@@ -116,7 +116,7 @@ rollout OK, live env verified 0.113.0, clean hub startup log. Demo: no churn (al
   exposed in a session screenshot during Phase D. Rotate it + move to a `secretKeyRef` (the
   Resend-key pattern, documentation/runbooks/secrets.md) as the next operator hygiene task.
   **DISPOSITION 2026-07-13 (hub v0.53.0):** de-git DONE (`secretKeyRef: report-api/REPORT_API_KEY`
-  + `scripts/manifest_secret_gate.py`); the value rotation is the supervised procedure in
+  + `scripts/manifest_bearer_gate.py`); the value rotation is the supervised procedure in
   documentation/runbooks/secrets.md §"Operator/global bearer key".
 
 ## END STATE

documentation/pilot/RUNBOOK-publish-0.85-0.120-2026-07-12.md

@@ -96,7 +96,7 @@ floor lands his controller at 0.120 automatically.
   carried over from the 0.81/0.113 train. Rotate + move to a `secretKeyRef` (Resend-key pattern,
   documentation/runbooks/secrets.md) as an operator hygiene task.~~
   **DISPOSITION 2026-07-13 (hub v0.53.0):** moved to `secretKeyRef: report-api/REPORT_API_KEY`
-  (literal removed from the manifest; `scripts/manifest_secret_gate.py` blocks reintroduction).
+  (literal removed from the manifest; `scripts/manifest_bearer_gate.py` blocks reintroduction).
   The value ROTATION itself is the supervised step in documentation/runbooks/secrets.md
   §"Operator/global bearer key" — the git-history copy is dead only after it runs.