The forker makes the only commit before the sanitizer and packager run,
and Step 7 publishes with `gh repo create --source=. --push`, which sends
commits, not the working tree. Packager output (LICENSE, README, CLAUDE.md,
setup.sh) never reached the public repo, and a secret the sanitizer caught
and the agent fixed in the working tree was still pushed in that commit.
- Fold sanitizer fixes and packager output into the single commit with
`git commit --amend`, keeping FORK_REPORT.md and SANITIZATION_REPORT.md
out through .git/info/exclude.
- Re-run the sanitizer after packaging (Step 5b) and refuse to push with
uncommitted changes or more than one commit.
- Sanitizer Step 6 now runs the Step 1 secret patterns and Step 3 home
path patterns over `git log -p --all`, not only a 4-keyword grep.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit fe767e2099)
Wen
3906ba98f3