chore(guard): sync vendored public-repo-guard to canonical

[wave-av-release-bot]

Syncs the vendored public-repo-guard trio to the canonical source in wave-foundation/scaffolder/public-repo-guard.

• adds the internal-ip leak rule (Tailscale-CGNAT 100.64.0.0/10), lockstep with the pre-publish mirror gate
• reconciles accumulated drift in the vendored copy

Each changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own Secrets + content policy gate re-scans this PR.

🤖 Generated with Claude Code

---

---

Summary by cubic

Syncs the vendored public-repo-guard with wave-foundation/scaffolder/public-repo-guard. Adds the internal-ip leak rule for Tailscale CGNAT (100.64.0.0/10) and hardens the scan workflow.

• Dependencies
  • Bump actions/checkout from v5.0.1 to v7.0.0.
  • Set persist-credentials: false so the job token isn’t available during the gitleaks scan (no git push needed).

^{Written for commit dd0fd4d. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Verify the commit SHA actually corresponds to checkout v7.0.0

The action is pinned by SHA with a trailing # v7.0.0 comment. The security value of the pin depends entirely on that SHA being the real v7.0.0 tag commit of actions/checkout; the comment cannot be validated from within this repo. Worth a one-time manual confirmation against the upstream tag before merge.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in dd0fd4d. This CI workflow update (checkout version bump + persist-credentials security hardening) is low-risk, but the changed file is owned by wave-av/core-team and should be reviewed by the designated owners.

^{You can customize Macroscope's approvability policy. Learn more.}