scripts/public_secret_scan.py: every PUBLIC repo, every object (incl. unreachable + PR refs), secret_shapes patterns, excused by the secret-guard allow list. Output JSON with hash8 + location only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>