chore: tracker-leak pre-push scanner needs CI-side backstop + wider coverage

[anandgupta42]

Found during v0.9.7 release review (CTO + Chaos Gremlin personas), and already self-disclosed in the originating commit (205a953 / PR #1085).

The pre-push tracker-leak scanner (script/check-tracker-leaks.ts) currently:

• Covers exactly two patterns: Jira key (\bAI-\d+) and the altimateai.atlassian.net hostname.
• Has no CI-side mirror — the originating PR deferred this because the session's token lacked workflow scope to add .github/workflows/*.
• Is bypassable via SKIP_TRACKER_CHECK=1 or simply never installed (git config core.hooksPath .husky is opt-in).

A contributor merging via the GitHub UI, the API, or without the hook installed gets zero enforcement today. The scanner's own docs ('public repo hardening') can read as more comprehensive than it is.

Suggested follow-up:

1. Add a CI job mirroring the pre-push check (needs a workflow-scoped token).
2. Widen RULES to cover other internal-only hostnames referenced in this repo's own .claude/rules/* (e.g. onealtimate.com), not just the Atlassian one.
3. Consider whether customer/tenant name patterns or credential-shaped strings (AWS keys, connection strings) belong in scope, or should be a separate secret-scanning tool.