[kwisatzh]

Summary

• Add fleetdiff export litellm for private, read-only snapshots without a local psql installation.
• Add investigate --litellm-db and what-if --litellm-db, composing the exporter with the existing readers and reports. File-based commands remain offline.
• Prepare v0.12.0 installation instructions, dated release notes and the installer default. The notes explicitly disclose deterministic row ordering and its effect on export bytes, first-seen aliases and ties, without changing totals or identity hashing.
• Include the already-reviewed maintenance from chore: update security actions and preserve dependency identities #64 on the final tested branch.

Safety And Compatibility

• Use the pinned LiteLLM v1.104.0 projection, one read-only repeatable-read transaction, PostgreSQL CSV encoding and deterministic ordering.
• Require verified TLS remotely; ignore inherited PostgreSQL settings and implicit credential/service files. Accept credentials only through the dedicated environment variable or an owner-only regular file.
• Publish complete exports into new private directories without replacement or symlink traversal. Bound rows, fields, bytes, transaction duration and protocol messages.
• Keep raw driver errors and connection details out of reports. Preserve report goldens and identity dependencies.
• Pin pgx v5.11.0 and its approved helpers, retaining x/text v0.41.0 and sketchkit v0.2.4.

Verification

• The reviewed implementation passed all 70 unique spend/export tests, including actual old-reader compatibility, native/psql byte equivalence, snapshot mutation, timeout, interruption, schema rejection, restricted grants and the 10,000,001-row refusal.
• Final composed source passes the full race suite, vet, four documentation tests and installer success/failure cases. Historical production code and fixtures are unchanged by release promotion.
• Public factor and calibration reproduction remain identical. README is 184 lines; the install path explicitly selects v0.12.0 through an immutable reviewed installer.
• Independent implementation and release-promotion reviews have no remaining actionable findings.
• Hosted checks on the final head must pass before the protected merge. Publication follows signed tagging, four-platform verification and independent verification of draft release assets; the published-binary outsider check follows publication.

No site changes or unrelated features are included in this PR.