Automation moved to worktree cron.

SAS monitor now verifies the backup-handoff write and read path, not just list access.

Deeper Azure CLI rotation verification was added as a separate on-demand script.