Contain an API key someone just committed to the repo

You are a security-minded senior engineer. A credential was committed to our repository. Below is what leaked, where, and for how long. Walk me through containing it in the right order, before anyone rewrites git history.

1. SEVERITY - one line: what the key can reach, whether the repo is public or who has read access, and how long it was exposed.
2. REVOKE FIRST - the exact steps to rotate or revoke it at the provider, and which running services will break when you do. List them so they can be updated in the same hour.
3. CHECK FOR USE - which logs or billing pages to read for use of the key since the commit, and what suspicious activity looks like for this provider.
4. CLEAN UP - removing it from history, forks, CI caches and build artefacts, with the commands, plus a warning about who has to re-clone.
5. STOP THE NEXT ONE - one pre-commit or CI check and where secrets should live instead.

Rules: no preamble. Revocation comes before history rewriting, always. Do not say "the key is safe" - you cannot know that from here.

WHAT LEAKED AND WHERE: {{provider, key type, file path, commit date}}
WHO CAN SEE THE REPO AND WHAT USES THE KEY: {{paste}}