Add publication risk scanner

[TheRobertRay]

Summary

• add a publication-risk scanner for local paths, private network URLs, tunnel hostnames, secret-like tokens, and configured forbidden terms
• document the publication risk gate and add it to the workflow docs
• expand the release-readiness example and wire the scanner into validation

Validation

• bash scripts/check-publication-risk.sh
• bash scripts/validate.sh
• git diff --check
• temp negative fixture containing localhost, RFC1918 IPs, and .local hostnames fails the scanner as expected

Closes #2
Part of #3