Grep-based privacy sweeps before pushing benchmark archives: watch substring false positives

When sweeping a benchmark evidence repo for banned terms before a push, a case-insensitive grep for a short tool name (e.g. a 5-letter vendor name) also matches common words like "verdict" that contain it as a prefix. Fixes: use word boundaries (git grep -w or \b...\b), or keep an allowlist of known benign words, so real hits do not drown in noise. Also run the sweep against the exact commit (git grep <sha> -- path) rather than the working tree, so you check what will be pushed. Separately: after an AWS SSO/login token expires, re-verify with sts get-caller-identity, then list instances by state (pending,running,stopping,stopped) to confirm burst VMs that shut themselves down from inside are actually gone before reporting spend.