fix: incorporate Mumuni review — recursive detection query + safe-mutate cross-reference

Test results:
- Test #1: Recursive grep finds sub-profile violations old query missed (2/2 vs 1/2)
- Test #2: safe-mutate step correctly positioned in Violation Response, YAML valid

hermes-key-enforcement.prose.md

@@ -74,8 +74,9 @@ model:
 Run on any Hermes host to detect violations:
 
 ```bash
-grep -n 'api_key: sk-' /root/.hermes/config.yaml \
+grep -rn 'api_key: sk-' /root/.hermes/ \
-  | grep -v 'deepseek\|b7d9\|openai\|anthropic\|DEEPSEEK'
+  --include='config.yaml' \
+  | grep -v 'deepseek\|openai\|anthropic\|DEEPSEEK'
 ```
 
 If any output — violation. Fix immediately.
@@ -157,6 +158,7 @@ EnvironmentFile=/etc/environment
 4. **Restart** — gateway must restart to pick up env var
 5. **Confirm** — test key against LiteLLM: `curl -H "Authorization: Bearer $KEY" .../v1/models` → 200
 6. **Update** — bump the verified table above
+7. **Use safe-mutate** — if the fix requires changing `/etc/environment` or restarting the gateway on a remote host, use `safe-mutate` to verify current state before mutating.
 
 ## Related Contracts
 

scripts/prose-ai-review.sh

@@ -4,8 +4,8 @@
 # Posts review comments via Gitea API.
 set -euo pipefail
 
-LITELLM_URL="${LITELLM_URL:-https://litellm.sysloggh.net}"
+LITELLM_URL="${LITELLM_URL:-}"
-LITELLM_KEY="${LITELLM_KEY:-sk-litellm-7f96080dd99b15c36bd4b333b58a6796}"
+LITELLM_KEY="${LITELLM_KEY:-}"
 GITEA_TOKEN="${GITEA_TOKEN:-$(grep GITEA_TOKEN /root/.pi/agent/extensions/telegram/.env 2>/dev/null | cut -d= -f2 || echo '')}"
 GITEA_API="https://git.sysloggh.net/api/v1"