Rolling the corrected sign-on rules across all protected sites

Roughly 107 protected sites still carry the older sign-on rules that infer their own address. They work today, so this is preventive rather than a repair.

The rollout is deliberately paced: bulk changes against the code-hosting service previously exhausted its request limit and produced a large batch of false build failures, so each site is spaced well apart and verified individually.