repo-scrublisted

User-invoked only (`/repo-scrub`) because it rewrites history and force-pushes. Making a GitHub repo public is effectively one-way — once it's public, forks/caches/scrapers can have already copied the history within minutes. GitHub gives no hook to intercept its own visibility toggle, so never rely on it: do all cleanup *before* the repo goes public, then flip visibility yourself via `gh`. This is a destructive, multi-step workflow. **Never proceed past a numbered gate without the user's explicit go-ahead. Never silently drop a finding from the report — every secret and every large blob found must be shown, even if the user ends up choosing to keep it.** ## 0. Before starting Confirm with the user which repo this is for if not obvious from context or the `owner/repo` argument. Confirm they understand this will rewrite git history (if they choose to scrub anything) and force-push — not a small operation. ## 1. Prerequisite check Run each version check; if missing, tell the user the install command and stop until it's installed (don't try to silently work around a missing tool): - `gh auth status` — should already be authenticated. If not, tell the user to run `gh auth login`. - `gitleaks version` — if missing: Windows `winget install --id Gitleaks.Gitleaks -e`; mac/linux `brew install gitleaks` (or GitHub releases). Note the version: v8.19+ uses the `gitleaks git` subcommand; older versions use `gitleaks detect --source`. - `git filter-repo --version` — if missing: Wind