feat(leak-scan): reusable workflow, allowlist contract, and docs

[joepetjr]

Summary

• Rebuild of feat(leak-scan): reusable workflow, allowlist contract, and docs #5, which auto-closed when the feat(leak-scan): scanner that keeps one repo's content out of another #4 merge deleted its base branch instead of retargeting. Content is identical (verified: the feat(leak-scan): scanner that keeps one repo's content out of another #4 squash tree matches the commit feat(leak-scan): reusable workflow, allowlist contract, and docs #5 was stacked on) with two fixes: the accidentally committed scripts/__pycache__/*.pyc files are dropped, and a one-line .gitignore keeps them out.
• Adds the reusable leak-scan.yml workflow (on: workflow_call). Callers add four lines; self-name comes from ${{ github.repository }}, never config. Worktree scan by default; history: true opt-in for audits, because a history finding is unfixable by PR and a permanently red gate gets switched off.
• Adds the allowlist contract tests: rule+path+match+reason (≥20 chars) all required, entry suppresses only its exact rule/path/text triple, scope separates worktree from history.
• README documents the rules, the rejected candidate patterns, and the allowlist contract.

Test plan

• python3 -m pytest scripts/test_leak_scan.py -q — 28 passed locally on this branch.
• After merge, the nine caller PRs' leak-scan runs get re-run; each must produce a real check run (their current green is workflow-not-found, which creates no check).