Development record

launch bundle scanner skips the .lock extension as if binary, but lockfiles are text and can carry secrets, so an included .lock ships unscanned (same class as the .svg gap the launch-payload fix closed, but pre-existing and out of that scope). Flagged by the launch-payload fix agent.