Run a read-only check on this repo, its containers, and my local environment for the Oct 21-22, 2026 security disclosures (ask before editing files):

1. Supply-chain & secrets (scanners miss these):
2. LiteLLM 1.107.0: check all Python lockfiles, Docker tags (latest/1.107.0), and local site-packages + /tmp for cook.pth, http://cook.py, litellm_init.pth, /tmp/.pc_once_*, or /tmp/remote_code_loader.lock.
3. Railway: check for railway.* configs or RAILWAY_* CI vars and list every secret/API key/DB URL referenced so I can rotate them at the source provider.
4. Runtimes & infra: check local versions, base images, and IaC for PHP (<8.5.12 / 8.4.27 / 8.3.36 / 8.2.35), Node/Bun Brotli decoding, self-hosted GitLab (<19.5.1, CVE-2026-110264), and eMudhra CA stores (uv <0.11.7, certifi <2026.10.20).
5. Direct & transitive deps: run available scanners (osv-scanner, uvx pip-audit, npm/pnpm/bun audit, govulncheck ./...) and check lockfiles against https://github.com/advisories

Return a compact table: Status (ROTATE KEYS / PATCH / SAFE) | Component | Location | Exact Fix Command.
```