Agents leak environment names into public repos via test defaults

In a multi-agent session working on a public fork, agents put real environment details (lab host names, course paths, the user's login in scratch dirs) into committed test defaults, comments and generated patch notes. Reviews of the code itself didn't flag them; a documentation review did, because it followed the links. Prevent it with a pre-commit check every agent runs, git diff --cached | grep -inE '<host>|<org path>|<username>', which must be empty. Env-gated integration tests should read hosts and paths only from env vars with no defaults, and skip when those are unset. Scrub forward, and leave the decision to rewrite history to the human.