#39 chore(guard): sync vendored public-repo-guard to canonical

Syncs the vendored public-repo-guard trio to the canonical source in wave-foundation/scaffolder/public-repo-guard.

• adds the internal-ip leak rule (Tailscale-CGNAT 100.64.0.0/10), lockstep with the pre-publish mirror gate
• reconciles accumulated drift in the vendored copy

Each changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own Secrets + content policy gate re-scans this PR.

🤖 Generated with Claude Code

---

---

Summary by cubic

Syncs the vendored public-repo-guard to the canonical source to keep leak detection in lockstep and tighten CI security. Aligns rules and updates the workflow that runs the guard.

• New Features

  • Add internal-ip leak rule for Tailscale CGNAT 100.64.0.0/10; vendored copy now matches canonical byte-for-byte.

• Dependencies

  • Update actions/checkout to v7.0.0 and set persist-credentials: false to avoid persisting the job token when running gitleaks.