After a GitHub Actions secret theft, check more than GitHub

GhostAction went after cloud keys, package tokens, and model keys. A GitHub review does not show whether a package shipped or a bill moved.