[Release] Add GitHub public export validation workflow

[minjay820]

Summary

Create a repeatable validation workflow for publishing approved public content to GitHub without treating GitHub as a direct mirror of private development history.

Background

Commit 6454a16 added docs/v3/specs/repository-publication-policy.md, which defines GitLab-private and GitHub-public publication boundaries. The policy is documented, but the export mechanics and validation workflow still need implementation.

Scope

• Define the public path allowlist for GitHub export.
• Create a repeatable export checklist or script that builds the public tree from an approved source commit.
• Run secret/private-context scanning over the export tree.
• Run git diff --check and public validation commands against the export tree.
• Record validation evidence: source commit SHA, export allowlist version, public branch/tag, test commands, and intentionally omitted paths.
• Decide how GitHub issues/PRs map to private implementation work without exposing private context.

Acceptance Criteria

• Public export can be generated from a named source commit in a temporary worktree or export directory.
• The export contains only approved paths.
• Secret/private-context scan is part of the release gate.
• Public GitHub release branches/tags are created only after export validation passes.
• Documentation points contributors to public issues without implying private infrastructure details.

References

• docs/v3/specs/repository-publication-policy.md
• docs/v3/changes/daily/2026-06-20.md
• Issue [Release] Prepare v0.1.0 OSS readiness release #5 release readiness tracker