feat(leakage): externalize token data and gate the publication set at push

[flopperj]

Summary

Move the leakage guard from a working-tree check with in-tree token data to a
publication-set check driven by token data that lives outside every repo.
The in-tree token list was itself the leak the check existed to prevent; the
new arrangement removes that paradox and moves enforcement to the point where
history actually leaves the machine.

What changed

External token data. The token list no longer lives in this repo. An
overlay installer materializes it to
${XDG_CONFIG_HOME:-$HOME/.config}/dotfiles-guard/leakage-tokens.txt alongside
a company-context marker file. Semantics are fail-closed:

• marker absent → checks skip cleanly (public CI, fresh clones)
• marker present, list missing/empty → hard configuration error, never a
  silent pass
• findings → file/line references only; matched content is never echoed,
  because the checker's own output (CI logs, scrollback, pasted bug reports)
  is a publication channel

Pre-push gate (scripts/pre-push.sh). Auto-installed by install.sh via
_install_git_hook. Scans every outgoing commit in the pushed range — each
commit's full tree plus its metadata (author/committer identity and commit
message) — so a token buried in an intermediate commit, or in a commit
message, cannot reach a remote even if a later commit removed it from the
tree. The pre-commit hook stays as a fast working-tree early warning; the
pre-push hook is the enforced boundary.

Checker (scripts/check-no-leakage.sh). Gains a --commits mode that
reads commit SHAs from stdin and scans each commit's tree + metadata (used by
the pre-push gate). Content-free output. Distinct exit code (2) when the
marker exists but the list is missing or has no effective tokens.

Tests. tests/leakage-check.bats rewritten on synthetic tokens pointed at
fixture list/marker files, so the mechanism is fully testable in public CI
without the real token data. New tests/pre-push-hook.bats covers the
publication-set gate end-to-end. Install/hook tests updated for the new
pre-push wiring.

CI. .github/workflows/lint.yml shows the company-token scan as a
structurally skipped step on runners without the guard data — visible
non-execution, never a silent green. Lint, consult-grammar check, and the
synthetic-token suite still run everywhere.

Docs. PROTOCOL.md gets a "Cohort 3" section documenting the externalized
data + publication-set model. README.md and CHANGELOG.md updated to
reflect the new hook layout and the new test count (183 → 436).

Why

Two problems with the prior arrangement:

1. The token list was in-tree. The list enumerated the exact identifiers
   the repo must never contain, so the list itself was a leak by definition.
2. The check was working-tree-only. A token could sit in an intermediate
   commit's tree or in a commit message, get "cleaned up" in a later commit,
   and still ship to a remote in the middle of history.

Externalizing the data removes (1). Moving the primary check to pre-push,
scanning every outgoing commit's tree and metadata, closes (2).

Testing

• make test — 436 tests pass locally
• Public CI runs the mechanism tests on synthetic tokens; the company-token
  scan appears as a skipped step (no guard data on public runners)
• Manually exercised pre-push against a synthetic tokenized commit and
  confirmed the push is rejected with file/line references and no content
  echoed