feat: protect repositories with zero configuration

[megamen32]

What changed

A fresh installation is useful immediately, even when the user never runs init.

Zero-config behavior

• bare git-private2public scans the current repository immediately
• scans tracked files and full history with built-in credential rules
• git-private2public scan also works without .gitpublic
• in an interactive terminal, a successful first scan offers one-key pre-push protection ([Y/n])
• non-interactive/CI runs never prompt or mutate hooks
• Git worktrees are recognized

Publishing stays explicit

publish still requires source + target because that destination cannot be guessed safely. The error now explains this clearly while reminding users that scanning already works without setup.

Documentation

Quick start is now:

pip install git-private2public
git-private2public

init is documented only where it is actually needed: private → public publishing.

Safety

Also routes every local/history finding through the redacted report formatter so a zero-config scan never prints the full credential.

Validation

• 59 tests pass
• warnings treated as errors
• python -m py_compile passes
• git diff --check passes
• real clean repository scan passes with no config
• real credential fixture is blocked and displayed only as ghp_…1b2C