Development record

Nothing calls embargo.Check but the abcd embargo check command: the commit-msg hook, abcd lint outbound, abcd launch ship and the implement loop's pull-request bodies all publish text without running it, so an unpublished advisory's id, reserved CVE id or title reaches public history unless the person remembers to run the check by hand. Separately, advisory ids travel in gh's argv (the REST path names the advisory id), and the triage --reason, --exists-without and --cannot-help text travels in abcd's own argv, where any local account can read them from the process list while the call runs; the update bodies already go to gh on stdin.