chore: apply remaining security/docs/env updates