Public content safety screen

Deterministic scan blocks secrets, cards, private IPs, and clear admissions before they hit public boards, roadmap, changelog, or docs. Optional cheap model check on longer publishes when HOLLAHOOP_SAFETY_API_KEY or org BYOK is set. Visitor filters hide any older unsafe rows. See docs/PUBLIC_CONTENT_SAFETY.md.