Fix template formula and add mirror push helper

.gitignore

@@ -1,2 +1,3 @@
 __pycache__/
 *.py[cod]
+.secrets/

CHANGELOG.md

@@ -6,6 +6,7 @@
 - Added `First seen` to `Remediations` and `Unresolved for` to `Template` (`days` since first seen when first seen is before today).
 - Fixed `Template` key lookup to match CVEs even when `Remediations` CVE cells include extra leading/trailing spaces.
 - Updated key-driven `Template` formulas to return blank for missing source values (including exception date) instead of displaying Excel zero-date artifacts.
+- Fixed malformed `Template` `Unresolved for` formula that caused Excel to remove formula records from `sheet2.xml` during file recovery.
 - Added repository policy in `AGENTS.md` requiring blank output for missing key-driven auto-populated values.
 - Updated `scripts/build_tracker_workbook.py` default seed rows for the new column layout and status set.
 - Updated `README.md` workbook column definitions and behavior notes for exception dates and unresolved metrics.

scripts/build_tracker_workbook.py

@@ -370,7 +370,7 @@ def build_template_sheet(wb: Workbook, max_rows: int) -> None:
         ws[f"J{row}"] = (
             f'=IF(OR(A{row}="",$N{row}=""),"",'
             f'IF(OR(INDEX(Remediations!$I:$I,$N{row})="",NOT(ISNUMBER(INDEX(Remediations!$I:$I,$N{row})))),"",'
-            f'IF(TODAY()-INDEX(Remediations!$I:$I,$N{row})<=0,"",TODAY()-INDEX(Remediations!$I:$I,$N{row})&" days"))'
+            f'IF(TODAY()-INDEX(Remediations!$I:$I,$N{row})<=0,"",TODAY()-INDEX(Remediations!$I:$I,$N{row})&" days")))'
         )
         ws[f"K{row}"] = (
             f'=IF(OR(A{row}="",$N{row}=""),"",'

scripts/push_mirror.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SECRET_FILE="$ROOT_DIR/.secrets/mirror.env"
+
+if [[ ! -f "$SECRET_FILE" ]]; then
+  echo "Missing secrets file: $SECRET_FILE" >&2
+  exit 1
+fi
+
+# shellcheck disable=SC1090
+source "$SECRET_FILE"
+
+: "${MIRROR_USER:?MIRROR_USER is required}"
+: "${MIRROR_TOKEN:?MIRROR_TOKEN is required}"
+: "${MIRROR_URL:?MIRROR_URL is required}"
+
+if ! git remote get-url mirror >/dev/null 2>&1; then
+  git remote add mirror "$MIRROR_URL"
+else
+  git remote set-url mirror "$MIRROR_URL"
+fi
+
+auth="$(printf '%s' "$MIRROR_USER:$MIRROR_TOKEN" | base64 -w0)"
+git -c http.https://git.andersentech.com/.extraheader="AUTHORIZATION: basic $auth" push mirror main:main