[infra] Make smartwatermelon/scripts public: secret audit, history rewrite, branch protection

[twistedmelonman]

Goal

Make smartwatermelon/scripts public. It is the one private repo in the
smartwatermelon org that runs Claude workflows, and that costs a third
annual token mint: on the Free plan an org-level secret does not reach a
private repo, so scripts carries its own repo-level
CLAUDE_CODE_OAUTH_TOKEN (see docs/token-rotation.md).

Going public removes that carve-out and lets the org secret cover it.

Why it is not just a visibility flip

The repo is 408 KB with history going back well before any secret hygiene
was in place. Flipping visibility publishes every commit, not just the tip.

Prerequisites, in order

• Secret audit. Scan the full history, not the working tree, for
  credentials. gitleaks detect --no-git=false or equivalent over all
  refs. Record what is found and where.
• History rewrite. Remove anything the audit finds, via
  git filter-repo. This rewrites every SHA, so it must land before the
  repo has outside forks or clones to break.
• Flip visibility to public.
• Add branch protection. scripts is currently unprotected — branch
  protection is not available on private repos on the Free plan, which
  is part of why it has none. Public makes it available; apply the same
  ruleset the other org repos carry (claude-review / run-review).
• Delete the repo-level CLAUDE_CODE_OAUTH_TOKEN once a workflow run
  proves the org secret reaches it, and update docs/token-rotation.md
  to drop the row.

Verification

A claude-blocking-review run on scripts that authenticates with no
repo-level secret present. Read the run log for the token, per the pattern
used in Step 5 of the migration — a green check alone is not evidence.

Context

Deferred out of the 2026-09 org migration by design
(docs/superpowers/specs/2026-09-03-org-migration-design.md, "Out of
scope"). Blocks W2's pilot re-pick, which needs a protected repo.

Note that plan=team currently reads on both orgs; that is temporary and
was bought for a support ticket. Do not use it as the basis for deleting
any private repo's token.