wrap

Cleanly wrap a work session — ground state against git+filesystem, update and de-bloat the tracking files, ensure the next-session landing pad is grounded (not invented), scan staged changes for leaked secrets, then commit (and push if there's a remote). Invoke at session end, or whenever the user says "wrap".