feat(cutover): develop directly on the public repo — relocate the leak gate, retire the publish machinery

[wshallwshall]

Switches MessageFoundry from the private-repo + published-mirror model to developing directly here.

The publish step was quietly enforcing several invariants. Retiring it means each one needs an explicit control, and this PR adds them.

The gate was vacuous on this repo

forbidden-content is a required check. Before this PR it invoked a scanner that had been deny-listed off the mirror, logged scan_forbidden.py absent (OSS mirror) — skipping, and exited 0. A required check that cannot fail.

It now runs the relocated scanner fail-closed over the whole tree, and hard-errors when the secret is absent on a non-fork run rather than degrading silently.

Presence is not sufficiency

Requiring a token source only proves one arrived. A partially-mangled secret previously loaded as few as 1 of 21 detectors and passed a gate calling itself fail-closed. So requiring tokens now also requires:

• every floor section (names/estate/site_prefixes) to be non-empty;
• a per-section floor. A bare total is a SUM, so growth in a cheap section masks collapse in an expensive one — names 7→1 alongside estate 13→19 still totals 21;
• entries that parse but can never fire to be rejected: an invisible/zero-width codepoint inside a token (it survives str.strip(), unlike NBSP — exactly what a paste through a rendering surface produces), the (?!) never-match sentinel, non-ASCII digit prefixes, and duplicates.

Detection gaps closed

• Identifier form. _ is a word character, so a \b-anchored pattern cannot see its token inside OB_TOKEN_ORU. A second pass with _ neutralised closes this for every name pattern. Restricted to single-token patterns — applied to multi-word patterns it matched 9 ordinary snake_case identifiers on the real tree, every one a false positive.
• Two detectors restored that were lost in the relocation (_WORKTREE_SLUG, _HOME_PATH), verified byte-identical to the originals.

Reason-only on every path, including failures

Parse warnings no longer echo the offending entry, and a REASON matching its own pattern is replaced with a generic label. Both would have published a customer token into a world-readable Actions log — on the success path, in the second case.

Also

• .pre-commit-config.yaml: the hook is added, not edited — publish.ps1 stripped it from every published snapshot, so it has never existed here. It carries --require-tokens, because pre-commit can pass args but cannot set env for one hook; without it a fresh clone commits with zero customer detectors and reports "Passed".
• Allowlist breadth validation: one degenerate entry (., .*) vetoed every line before any detector ran, disabling the gate while the counts line still reported full tables.
• security.yml gains a main-only push trigger — a fork PR is scanned structural-only by design, so nothing fully-loaded ever re-scanned fork-contributed content after merge.
• Two docs genericized: they wrote the real site prefix to describe the detector's shape. That is what takes a whole-tree scan from 3 hits to 0, and why no legacy path-exemption was ported — fixing the source beats exempting it.
• The gate's own tests no longer trip it; literal probes are assembled at runtime, matching the convention the suite already used for IPs.

Verified

whole-tree leak scan	exit 0, all 21 detectors, fail-closed
full suite	8,891 passed / 0 failed
console suite	338 passed; 1 failure reproduces on clean main, unrelated, tracked separately
ruff format	clean
ruff check / mypy	13 / 21 — identical to a baseline measured on main
mutation testing	21 targeted reverts of the new guards, 0 undetected