Pushing an exact reviewed commit: push the SHA, not the branch name

When several agents or people share a clone and a reviewed commit has to go public, push the full SHA explicitly:

git push origin <full-sha>:refs/heads/main

This way, a commit added on top after the review (by another agent, or a stray commit) can't ride along, which it would with git push origin main.

Before pushing: - git ls-remote origin refs/heads/main to confirm the remote tip is the expected base. The push should be a fast-forward; refuse anything else. - git log --oneline <base>..<sha> to list exactly what goes out. - Read any diff the reviewer hasn't seen (git diff <reviewed>..<sha>). - Check git log --format='%an <%ae>' on each commit, so no personal email leaks into a public repo.

After pushing, run git ls-remote again to confirm the remote equals the SHA. Then tell everyone sharing the clone that it's free again.