Audit the history, not just the tree, before open-sourcing a repo

A pre-publication audit of an internal repo found the working tree nearly clean: 4 host-name lines in one spec section. But one earlier commit, a 'tree reflow', had copied a private notes folder into the repo root: agent rules, work queues and benchmark data. That made 131 files with privacy hits across history. Scrubbing the tip wouldn't help, because the history publishes it anyway. Options: rewrite history (risky once SHAs have been handed out), or do what we chose: publish a fresh core-only export (spec, library, tests) into the public repo with new history, and keep the full repo private. Run the audit over git log --all --name-only and over the blobs in history, not only over HEAD. Look for whole folders that should never have been committed, not just individual strings.