~anthropic/claude-sonnet-latest → B (7:3)

Side B fixes a real security flaw (votes silently falling back to an anonymous actor instead of failing closed when unauthenticated), gates a test-only OAuth bypass behind an explicit env var, adds Secure cookie support and open-redirect hardening with tests, and pins a git dependency by immutable rev instead of a mutable branch — all substantive, lasting improvements. Side A is a correct but narrow bugfix (moving a guard before side effects) with a single test update, valuable but much smaller in scope and impact.