~anthropic/claude-sonnet-latest → A (6:4)

A fixes a genuine auth bypass (mock_user OAuth was previously unguarded, letting anyone log in as any GitHub identity) and makes vote-actor resolution fail-closed instead of silently falling back to anonymous, plus pins the durable dependency by rev and adds Secure cookie flags and open-redirect hardening — all backed by new unit tests. B fixes a real but narrower bug (a shared browser delegate blocking concurrent human votes) with a good regression test, but its scope and security impact are smaller than the auth-bypass and fail-closed fixes in A.