chore(guard): sync vendored public-repo-guard to canonical

[wave-av-release-bot]

Syncs the vendored public-repo-guard trio to the canonical source in wave-foundation/scaffolder/public-repo-guard.

• adds the internal-ip leak rule (Tailscale-CGNAT 100.64.0.0/10), lockstep with the pre-publish mirror gate
• reconciles accumulated drift in the vendored copy

Each changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own Secrets + content policy gate re-scans this PR.

🤖 Generated with Claude Code

---

---

Summary by cubic

Sync the vendored public-repo-guard to the canonical config to align security rules and behavior. Sets persist-credentials: false in actions/checkout so the job token isn’t available to third‑party scans, matching the canonical guard.

^{Written for commit 5bfeca2. Summary will update on new commits.}

Note

Disable credential persistence in public-repo-guard checkout step

Sets persist-credentials: false on the actions/checkout step in public-repo-guard.yml, syncing the vendored workflow with the canonical version. Risk: subsequent steps in the workflow will no longer have GitHub credentials injected into the Git config; any Git operations requiring authentication must now supply credentials explicitly.

^{Macroscope summarized 5bfeca2.}

[greptile-apps]

PR author is in the excluded authors list.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in 5bfeca2. This CI workflow change adds security hardening (persist-credentials: false) which is low-risk, but the changed file is owned by wave-av/streaming-team and the author (release bot) is not a designated owner. The code owners should review this sync.

^{You can customize Macroscope's approvability policy. Learn more.}

[wave-bugbot]

🌊 WAVE BugBot — 2 finding(s)

🔴 2

• 🔴 P0 .github/workflows/public-repo-guard.yml:46 — Unnecessary job token persistence
  The persist-credentials: false setting is unnecessary and could be removed to avoid potential security risks.
• 🔴 P0 .github/workflows/public-repo-guard.yml:46 CWE-798 — Unnecessary job token persistence
  The 'persist-credentials' option is set to false, which means the job token will not be persisted for later steps. However, this setting is unnecessary and can

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}