feat(leak-scan): scanner that keeps one repo's content out of another

[joepetjr]

Summary

A leak scanner for the org's public repos, plus its tests and a self-test workflow.
It checks that a repository publishes its own work and nothing else: no sibling
project's name, no client's name, no layout convention from the private monorepo
several of these repos were extracted from, and no absolute path from an authoring
machine.

Two design points worth review:

• The repo's own name is derived, never configured. --self-name is fed from
  ${{ github.repository }}, so a repo naming itself can never be a finding and no
  repo can be left holding a stale "this is me" setting the scan then stops
  enforcing. The lookahead ends the name ((?!driftless(?:\.git)?(?![\w.-])))
  rather than using \b, because a word boundary sits between driftless and the
  - of driftless-archive — the private sibling was the one name an earlier
  version of this rule could not see. That case is pinned in the tests.
• A public sibling is not a finding. Naming a repo anyone can already open
  discloses nothing, and the public set is read from the org API at scan time
  rather than hand-listed, since a hand-kept list goes stale the day a repo is
  published. If the lookup fails the scan stops rather than guess. The endpoint is
  public, so no extra token scope is needed.

The gate covers the worktree. --history scans every blob reachable from every ref
and is meant for audits, not the PR gate: only a force-push removes a published
blob, so a history gate would be permanently red on content no PR can fix.

Pattern set, and what was rejected

Every pattern was run against fresh clones of all thirteen public repos before it
was kept. Candidates that fired on legitimate content were dropped rather than
tightened:

Rejected	Why
GMS	A test fixture project name in driftless (134 hits) and the industry term "grant-management-software (GMS)" in grantbridge (10 hits).
gomoveshift	A public brand. The internal service references it appears in are already caught by _active/.
workspaces	Ordinary English — "multi-project workspaces", "CI workspaces".
openclaw	A third-party product (docs.openclaw.ai) that rigscore legitimately supports as an MCP client.
/home/<user>/ (general)	These repos document themselves with illustrative paths like /home/user/project. Only the two real authoring accounts are matched.
backroadcreative	The brand email and domain, not the private repo.

.data/ was tightened to require a following path segment, so a bare .gitignore
line — which names no internal file — is not a finding.

Test plan

python -m pytest scripts/test_leak_scan.py -q — 20 tests, run by the new
selftest workflow on every PR and push. The negative cases are the load-bearing
ones: an over-eager scanner gets switched off, and a switched-off scanner protects
nothing.

Also run end-to-end against fresh clones of all thirteen public repos; results are
in the accompanying report.