sec: harden modal worker, update deployment docs, and add pre-push safety checks

c4fd681