chore(guard): sync vendored public-repo-guard to canonical

[wave-av-release-bot]

Syncs the vendored public-repo-guard trio to the canonical source in wave-foundation/scaffolder/public-repo-guard.

• adds the internal-ip leak rule (Tailscale-CGNAT 100.64.0.0/10), lockstep with the pre-publish mirror gate
• reconciles accumulated drift in the vendored copy

Each changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own Secrets + content policy gate re-scans this PR.

🤖 Generated with Claude Code

---

Note

Update public-repo-guard workflow to use actions/checkout v7 without persisted credentials

Syncs public-repo-guard.yml to the canonical version. Upgrades actions/checkout from v5.0.1 to v7.0.0 and sets persist-credentials: false so the GITHUB_TOKEN is no longer stored in the repository's Git config after checkout.

^{Macroscope summarized b3d2ef6.}

---

Summary by cubic

Syncs vendored public-repo-guard with the canonical repo to align leak rules and workflow hardening. Adds the internal-ip rule for Tailscale CGNAT (100.64.0.0/10), bumps actions/checkout to v7, and disables persist-credentials during scans.

^{Written for commit b3d2ef6. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in b3d2ef6. This PR updates a workflow file owned by wave-av/streaming-team, but the author (wave-av-release-bot) is not a designated owner. While the change is a straightforward security improvement (version bump + persist-credentials: false), the designated code owners should review changes to their files.

^{You can customize Macroscope's approvability policy. Learn more.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Checkout pin now inconsistent with the rest of the workflows (v4 elsewhere)

This bumps only public-repo-guard.yml to checkout v7 (.github/workflows/public-repo-guard.yml:45), while .github/workflows/_checks.yml:23,54,114 remain pinned to v4.3.1 and still persist credentials by default. If the intent is the zizmor artipacked hardening, the same persist-credentials: false treatment likely belongs on the other checkout steps too (they run tests/builds, none of which appear to need an authenticated Git remote). Worth confirming whether the other workflows were intentionally left alone.

---

Was this helpful? React with 👍 or 👎 to provide feedback.