healthchecks.io UUIDs: malformed citations UUID and plaintext ping credentials

Two related problems with the healthchecks.io ping UUIDs in .github/workflows/run_pipelines.yml (lines 63-70 on main as of 747a8a4). Both are pre-existing; surfaced while reviewing #141 and explicitly left out of scope there.

1. The citations UUID is malformed

- pipeline: citations
  uuid: 40694d0-50ed-4bb7-919d-463d3555b23f   # line 68

The first group is 7 hex characters; a UUID requires 8. The other three pipelines are all well-formed:

Almost certainly a dropped character when the UUID was pasted in.

Unverified: whether healthchecks.io actually rejects pings to a malformed UUID. It may 404, or it may normalize. Someone with dashboard access should check the citations monitor's ping history before assuming it has been silently dead — please confirm rather than just fixing the string, since a monitor that has never reported is a different situation from one that reports fine.

Worth noting this class of bug is invisible in CI: runitor pings are fire-and-forget, so a bad UUID produces no build failure. If a check is cheap, validating the UUIDs in the workflow (or a pre-commit hook) would catch the next typo.

2. All four UUIDs are plaintext in a public repo

A healthchecks.io ping URL is a bearer credential: anyone who can read it can ping the endpoint. With these four committed in a public repo, a third party can:

• send fake success pings, masking a genuinely dead pipeline (the monitor looks green while nothing runs)
• send /fail pings, triggering false "pipeline is down" alerts

That second one is the same symptom #141 just fixed from the CI side, reachable by anyone. Moving the UUIDs to repository secrets and referencing them from the matrix would close it.

Note this is not urgent-by-regression: the exposure predates #141, and #141 reduced the number of automated pings rather than increasing it. But since the values are already public, rotating on move is worth doing — a secret that has been committed is no longer secret.

Suggested resolution

• Check the citations monitor's ping history on healthchecks.io — has it ever received a ping?
• Fix the malformed UUID on line 68 (recover the correct value from the dashboard, not by guessing the missing character)
• Move all four UUIDs into repository secrets, rotating them as part of the move
• Optionally validate UUID format in CI so a future typo fails loudly instead of silently

Context

• Found during review of #141 ("Don't ping production healthchecks.io monitors from PR CI runs")
• Deliberately excluded from #141 to keep that diff minimal; the merged change does not touch these lines
• The runitor path itself is still awaiting real CI coverage — it first exercises on push-to-main or the nightly schedule, since PR runs skip runitor by design

Start with .github/workflows/run_pipelines.yml, especially lines 63-70, and check the citations monitor's ping history in healthchecks.io. Recover the correct UUID from the dashboard rather than guessing, rotate all four exposed credentials into repository secrets, and verify the workflow references them correctly. Done means the citations monitor is confirmed, the malformed value is fixed, and plaintext credentials are removed.