Add CI leak check

[manav8498]

For mxx1111/spare-cycles#1

Summary

• add a GitHub Actions leak check on pull requests and pushes to main
• fail CI when config.yaml, config.yaml.bak, or anything under data/ is committed
• scan non-Markdown tracked files for hardcoded IPv4 literals, with a narrow allowlist for existing demo/example literals
• document the CI enforcement and allowlist process in both CONTRIBUTING sections

Security impact

This adds CI-only validation. It does not expand dashboard runtime privileges or add write operations.

Verification

• python3 -m py_compile scripts/check_leaks.py
• python3 scripts/check_leaks.py
• staged temporary negative fixtures for config.yaml, data/, and a hardcoded IPv4 literal; the script failed as expected, then the fixtures were removed before commit

[mxx1111]

已合并到 main：a105f4e，署名保留为你。显示 closed 而非 merged 是因为 PR 含 .github/workflows/ 文件，维护者 token 缺 workflow scope，GitHub 合并 API 拒绝——改成本地 squash + SSH 推送。

合并前逐项实测过：

干净树                              exit 0, Leak check passed.
注入 10.4.22.19 / 192.168.31.5      exit 1, 两条都报出文件和行号
强制 add config.yaml + data/        exit 1, 两条都报出
合并后 main 上首次 CI 运行           绿

allowlist 的设计是这次交付里最关键的部分。 一个防泄露检查活不活得下来，取决于它误报时人们是去加精确豁免还是去放宽正则。你把条目做成 <path-glob>: <literal>、限定到单个文件和单个值，* 只出现在 demo/example 上（跟你自己写的头部注释一致），任务里警告过的版本号误报（frontend/index.html 里的 1.2.3.4）也是用一条窄豁免解决而不是改匹配规则。这是对的做法。

一个不影响验收的小意见：scripts/tailscale-cgnat-fix.sh 用了 *，但它既不是 demo 也不是 example。那个文件里只有两个字面量（100.100.100.200 和 100.64.0.0/10，都是 Tailscale CGNAT 常量），写成两条精确条目更符合 allowlist 自己的规则。已记在合并 commit 里，不用改。

---

Merged as a105f4e, authorship intact. Shows as closed rather than merged because the PR touches .github/workflows/ and the maintainer token lacks workflow scope; squashed locally and pushed over SSH.

Verified: clean tree passes, injected private IPs are caught with file and line, force-added config.yaml and data/ are caught, and CI is green on main. The allowlist design is the part that matters most — narrow path: literal entries, * only on demo files, and the version-string false positive handled by exemption rather than by loosening the pattern.