chore(guard): sync vendored public-repo-guard to canonical

[wave-av-release-bot]

Syncs the vendored public-repo-guard trio to the canonical source in wave-foundation/scaffolder/public-repo-guard.

• adds the internal-ip leak rule (Tailscale-CGNAT 100.64.0.0/10), lockstep with the pre-publish mirror gate
• reconciles accumulated drift in the vendored copy

Each changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own Secrets + content policy gate re-scans this PR.

🤖 Generated with Claude Code

---

---

Summary by cubic

Syncs the vendored public-repo-guard with the canonical source and hardens the CI scan by updating actions/checkout and dropping persisted credentials.

• New Features

  • Add internal-ip leak rule for Tailscale CGNAT 100.64.0.0/10.

• Dependencies

  • Update actions/checkout to v7 and set persist-credentials: false to avoid exposing the job token during scanning.

^{Written for commit 7d41487. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Checkout action version now inconsistent across workflows

This workflow is pinned to checkout v7.0.0 while .github/workflows/lint.yml:16 uses v6.0.3 and .github/workflows/_checks.yml uses v4.3.1 in three places. Not a functional bug, but the other workflows retain the default persist-credentials: true and are drifting; consider aligning pins and applying the same hardening repo-wide.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in 7d41487. This CI workflow update (actions/checkout version bump and persist-credentials security improvement) is low-risk, but the file is owned by wave-av/core-team and the bot author is not a designated owner. Human review from the code owners is warranted.

^{You can customize Macroscope's approvability policy. Learn more.}