GitHub Actions Checkout v7: Why Fork Pull Request Safety Required a 362KB Credential Isolation Rewrite

How GitHub Actions moved credentials out of .git/config into $RUNNER_TEMP to prevent pwn-request attacks and what the ESM migration reveals about CI/CD...