Pre-landing review (1 critical, 4 informational):
- CRITICAL: per-project `secrets verify` during the migration window flagged
the freshly-written v2 twin as a spurious orphan and exited 1 (store still
reads v1, so verify's expected set only held the .gradle-properties.age name).
Breaks the documented migrate->verify->finalize workflow and CI. Fix: verify's
orphan set now accounts for BOTH suffix forms of a properties external, so the
twin is never a false orphan mid-migration. Regression test added.
- Copy-forward now pushes the twins (mirrors push/rekey) so a --finalize on
another machine sees them; previously twins were local-only until finalize,
a multi-machine footgun.
- Dropped the undocumented `--force` alias (keep `--yes`).
- Clarified the EGB-700 comment (which-format line, folded into EGB-703).
Deferred to EGB-701: the two finalize find-walks over *.gradle-properties.age
could collapse to one pass. Full suite 236/236.
c10e89fb51