v0.2.1

Hardening release. New defensive mechanisms around accidentally committing private data plus the public-release CI surface (CI, secret scan, automated release notes from CHANGELOG).

Added

• codesage install-hooks now installs a pre-commit hook when the repo contains scripts/leak-check.sh. The hook greps staged content against extended-regex patterns from scripts/leak-patterns.txt (tracked, shared) and .git/info/leak-patterns.txt (local-only, per-developer) and blocks the commit on a match. Bypass with git commit --no-verify when a false positive is intentional.
• scripts/leak-patterns.txt with default patterns for private-key material and common token formats (AWS, GitHub PATs, Slack, Stripe live keys).
• Pre-commit filename policy. The hook blocks any staged file whose name matches a secret/credential pattern: .env* (except .example, .template, .sample), .secret, .secrets/, *.pem, *.p12, *.pfx, id_rsa* / id_dsa* / id_ecdsa* / id_ed25519* (except .pub public-key variants), credentials.json, service-account*.json.
• scripts/leak-check.sh supports --range A..B and --all modes so the same script powers both the pre-commit hook and CI.

Changed

• .gitignore excludes benchmark artifacts under bench/ (results, corpora, history, scorecards) and common secret filenames (.env*, *.pem, id_rsa*, credentials.json, etc.) so local data never enters a commit by default. Template files (.env.example, .env.template, .env.sample) remain committable.