backup

Backup the entire workspace to GitHub. ## CEO two-part topology (engine + data): use `push-all.py` The CEO workspace is split into two repos — the ENGINE clone (`.heading-os`, code only) and the DATA overlay (`.heading-os-data`, all data + every artifact), each with its own private `origin/main`. The single command that commits and pushes BOTH, with a pre-push secret scan and an ahead/behind `[0 0]` verification (a bare push can silently leave a ref behind), is: ``` python scripts/push-all.py # commit working-tree changes + push both python scripts/push-all.py -m "msg" # custom commit message python scripts/push-all.py --no-commit # push existing commits only python scripts/push-all.py --dry-run # show what would happen, change nothing ``` It reads `GH_TOKEN` from the engine `.env`, refuses to push any tracked secret-like file (`.env`, `.session`, `cookies.json`, `.sessions/`), and never pushes `.memory-index/` (gitignored, rebuildable). Prefer this over the manual git steps below whenever the data overlay exists (`get_data_root()` differs from the engine root). The manual steps remain the path for exec workspaces and the pre-cutover single-repo case. ## Exec workspaces: also `push-all.py` An executive workspace is the same two-repo topology from the exec's side: a READ-ONLY engine clone (`.heading-os`, consumed via `git pull`; its origin is the CEO's engine repo, so the exec cannot push it) and a WRITABLE data overlay (`heading-os-data-{slug}`). `push-...