npub1cch64exjvxqm26wqz92835l53krvw2k9mu3s804m5m0rnhmzfxpsjwf8nu (npub1cch…f8nu) Thats a good point, thank you, and really, I'd like to be able to say "That's a bad idea." :)
Even if an attacker removes it, having a history of "Don't run this code" or "don't run any code from the repo" is a thing that supply chain security tooling could note and/or flag.