publish-gatelisted

A leaked key, a private IP, or a personal path in a public repository is effectively irreversible. GitHub keeps pushed commits reachable after deletion and after force-pushes: they "may still be accessible ... directly via their SHA-1 hashes in cached views" ([Removing sensitive data from a repository](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository)), and in a fork network, "Commits pushed to any repository in a network can be accessible from other repositories in that network, including the upstream repository", and they "can remain accessible in the repository network even after a fork is deleted" ([About permissions and visibility of forks](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/about-permissions-and-visibility-of-forks)). Truffle Security documented in 2024 that this design is known to GitHub and intentional ([Truffle Security](https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github)). Cleanup requires a support ticket plus credential rotation, and the rotation is the part that actually protects you. The only real defense is that a dirty commit never leaves your machine. Before anything goes public, this pipeline runs in full, in this order. Never skip a gate. Never mark one passed by assertion instead of evidence. Publishing means: making a repository public or creating one, pushing to a public repository, submi