Drift & rug-pull

Tracked servers are re-probed periodically. We pin a hash of the tool definitions (Tool Pinning): any post-approval mutation triggers an alert. 2 servers monitored.