fix(scripts): scan only committable files for leaks

[alphastorm]

Summary

Both leak scanners walked the raw filesystem with hand-rolled skip lists, so an ignored RepoPrompt export under prompt-exports/ (globally gitignored) carrying a home path turned the local bun run check red today while CI was green. The scanners' contract is what a commit could carry — the workflow comments already describe them as reading tracked text — so they now list files through git:

• scripts/repository-files.ts: git ls-files -z --cached --others --exclude-standard minus --deleted; nested repositories (which git reports as one dir/ entry, e.g. .qualification/oh-my-pi/ in the ARM64 job) are skipped.
• Both scanners drop their private walk() and skip lists; exemptions and extension filters are unchanged.
• Shipped bytes stay covered where they ship: build-release.ts already runs findCapabilityLeaks over every archive member, so no longer scanning ignored apps/web/dist output loses nothing.

Validation

• New scripts/repository-files.test.ts: temp git init with a committed file, a file deleted from the working tree only, an untracked file, a .gitignore-excluded directory and pattern, and a nested repository — exactly .gitignore, new-untracked.ts, tracked.md are listed.
• Red→green on the real trigger: with the ignored export present, the old identifier scanner fails on prompt-exports/…:58: absolute home path; the new one passes. An untracked probe file with a home path still fails the new scanner (exit 1, correct path reported).
• bun run check on the branch: repository check, typecheck, build, 610/610 tests, both scans pass.

Security and privacy impact

• No capability, readiness token or OMP discovery token, transcript, or private identity is included in this PR or its artifacts.
• Authentication/authorization impact: none.
• Browser storage/cache/history impact: none.
• Logging/diagnostics impact: none.
• OMP lifecycle/generation impact: none.
• Leak-detection coverage: unchanged for committable files; ignored build output is covered by the release-archive scan.
• docs/SECURITY.md and ADRs: no trust boundary changed.

Compatibility

Not applicable; repository tooling only.

Documentation

• Not user-visible; no changelog entry.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.04%. Comparing base (5c92fd8) to head (7e10b9b).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #185      +/-   ##
==========================================
+ Coverage   66.97%   67.04%   +0.07%     
==========================================
  Files          35       36       +1     
  Lines        9659     9680      +21     
==========================================
+ Hits         6469     6490      +21     
  Misses       3190     3190              

Files with missing lines	Coverage Δ
scripts/repository-files.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.