chore(guard): sync vendored public-repo-guard to canonical

[wave-av-release-bot]

Syncs the vendored public-repo-guard trio to the canonical source in wave-foundation/scaffolder/public-repo-guard.

• adds the internal-ip leak rule (Tailscale-CGNAT 100.64.0.0/10), lockstep with the pre-publish mirror gate
• reconciles accumulated drift in the vendored copy

Each changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own Secrets + content policy gate re-scans this PR.

🤖 Generated with Claude Code

---

---

Summary by cubic

Syncs the vendored public-repo-guard to the canonical wave-foundation/scaffolder/public-repo-guard to keep leak rules aligned and tighten the CI scan. Updates the guard workflow to use actions/checkout v7 and stop persisting the job token.

• New Features

  • Add internal‑IP leak rule for Tailscale CGNAT 100.64.0.0/10 (mirrors the pre‑publish gate).

• Dependencies

  • Upgrade actions/checkout to v7.0.0.
  • Set persist-credentials: false to drop the job token before running gitleaks over the working tree.

^{Written for commit 6b125d5. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Verify the pinned commit SHA actually corresponds to v7.0.0

The commit SHA 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 is annotated as v7.0.0. Since this workflow is the repo's security gate and the pin is the only integrity guarantee for the action, it is worth confirming the SHA resolves to the tagged release in actions/checkout (the rest of the job verifies gitleaks by SHA-256, so a mismatched action pin would be the weakest link).

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in 6b125d5. This CI workflow change (checkout version bump + security hardening) is low-risk, but the modified file is owned by wave-av/streaming-team and the bot author is not a designated owner. The CODEOWNERS team should review.

^{You can customize Macroscope's approvability policy. Learn more.}

[wave-bugbot]

🟢 WAVE BugBot — clear

No confident findings on the changed lines.

_{Local review · $0 inference · wave-dispatch}