Add a leak guard for GitHub issue/PR bodies (the pre-commit hook can't see them)

[clabonte]

Problem

The leak-prevention guard (FEAT-2026-0020) covers git commits only. GitHub issue and PR descriptions/comments are a separate public surface the pre-commit hook cannot scan. This is exactly where leaks landed during FEAT-2026-0020: the T04 sweep redacted 12 issue/PR bodies, and a example-iac reference reached PR #43's body afterward (caught only by a manual pre-flip sweep).

Proposal

A scheduled / issues+pull_request-triggered GitHub Action that runs the leak_scan patterns (structural + hashed denylist; see the hashed-denylist issue) over issue/PR titles, bodies, and comments, and fails / comments on a hit. Note: GitHub retains edit history of bodies, so the Action stops new leaks but cannot expunge already-published revisions — that remains a delete+recreate / GitHub-Support operation.

Acceptance

• Action flags a planted private string in an issue/PR body on open/edit.
• Clean bodies pass.
• Documented limitation: edit-history is not expunged by this guard.

Surfaced by FEAT-2026-0020 review.

[clabonte]

Closing — the headline ask shipped in FEAT-2026-0024 (PR #54, merged 2026-06-16, same day this issue was opened from the FEAT-2026-0020 review). The squash merge carried closes #46 only in a feature-branch commit, so GitHub never auto-closed it; the live-trigger acceptance was also intentionally left as an operator post-merge step (0024 GATE-02-REVIEW, open verification 5). Now verified.

Shipped (FEAT-2026-0024):

• .github/workflows/leak-scan-content.yml — triggers on issues (opened, edited), pull_request (opened, edited), issue_comment (created, edited)
• .specfuse/scripts/leak_scan_content.py — scans title/body/comment fields via leak_scan.scan_text (structural + denylist + hashed-denylist + gitleaks), exits non-zero on any finding (fails the check)
• docs/leak-scan-content-action.md — documents the edit-history-not-expunged limitation

Acceptance verified:

• Action flags a planted private string in an issue/PR body on open/edit — ✅ live-oracle: opened a throwaway issue with a planted fake token; the leak-scan-content check failed (run 27950577576):

  leak-scan-content: FINDINGS
    issue.body: line 1: user-path: '/Users/leak-oracle-probe/'
  ##[error]Process completed with exit code 1.
  

  (throwaway issue deleted after the check.)
• Clean bodies pass — ✅ covered by tests/test_leak_scan_content.py (scan_event clean cases) and every real non-leaking issue/PR event the Action has run on.
• Documented limitation: edit-history not expunged — ✅ in docs/leak-scan-content-action.md.

Deferred (optional enhancements, not in this issue's acceptance — open a new issue if wanted): posting a comment naming the offending field (needs issues/pull-requests: write scope), and a schedule: periodic re-scan of open issues/PRs.