chore: harden dual-remote git workflow

backend/workflows/templates/workflows/developer_handbook.html

@@ -104,6 +104,7 @@
       </ul>
       <pre><code>./scripts/git_remote_target.sh status</code></pre>
       <p>Use the helper above before pushing if there is any doubt about which remote should receive the change.</p>
+      <p>Plain <code>git push</code> should default to <code>origin</code>, and a repo-local <code>pre-push</code> hook blocks accidental pushes to <code>tubco</code> unless the ref is an approved TUBCO branch or baseline tag.</p>
     </div>
     <div class="box">
       <h3>Customer release branches</h3>
@@ -696,6 +697,7 @@ docker compose restart worker</code></pre>
       <pre><code>./scripts/git_remote_target.sh set-own-identity
 ./scripts/git_remote_target.sh set-tubco-identity</code></pre>
       <p>Switch between the normal commit identity and the TUBCO customer identity when needed.</p>
+      <p>For the TUBCO HTTPS remote, prefer a personal access token instead of a reusable account password.</p>
     </div>
     <div class="box">
       <h3>Direct server deployment</h3>