The PostSync hook now reads telegram-notify-infisical (synced from homelab/prod /telegram). Deleting this manifest prunes the old plaintext secret — the bot token leaves git for researchowl. Security win. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>