weekly public secret scan (all 5 GitHub accounts, full history, hash-only)

scripts/public_secret_scan.py: every PUBLIC repo, every object (incl.
unreachable + PR refs), secret_shapes patterns, excused by the secret-guard
allow list. Output JSON with hash8 + location only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci/secret-guard-allow.yml

@@ -44,3 +44,7 @@ allow:
     paths: ["tools/conformance/test-keys/*"]
     kinds: [private key block]
     reason: "Conformance-suite test keys (named test-private.pem)."
+  - repo: windy-git
+    paths: ["api/tests/test_secret_guard.py"]
+    kinds: [private key block]
+    reason: "The guard's own test uses a PEM header string as a sample."