scripts/public_secret_scan.py: every PUBLIC repo, every object (incl.
unreachable + PR refs), secret_shapes patterns, excused by the secret-guard
allow list. Output JSON with hash8 + location only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>