From #9018, which covered the preview; this is its open box for the check.
Done when:
[ ] A test opens a pull from another forge (or an outsider's fork), runs its check and finds none of the repository's secrets in the check's environment.
[ ] After a writer approves the pull, the same check runs again and has them.
[ ] The test fails if the env builder hands secrets to an unapproved guest.
Files: test/, the check runner's env builder (only if the test finds a gap).
From #9018, which covered the preview; this is its open box for the check.
Done when:
Files: test/, the check runner's env builder (only if the test finds a gap).