Scoped push tool means little if the container still has your SSH agent. Tool fails once and it just runs git push in the shell.

I hash the patch into the approval prompt now. Agent edits after I say yes, hash changes, publish refuses. How long do you expire approvals on a first deploy?