feat(publish): sanitize 鉤子(同步)

scripts/publish-github.sh

@@ -39,6 +39,11 @@ while IFS= read -r p; do
   rm -rf "${TMP_EXPORT:?}/$p"
 done < "$EXCLUDE_FILE"
 
+# 3.5) repo 自備的遮蔽腳本（可選）：對匯出樹做內容級遮蔽（如指南去帳密）
+if [ -f "$REPO_ROOT/scripts/github-publish-sanitize.py" ]; then
+  python3 "$REPO_ROOT/scripts/github-publish-sanitize.py" "$TMP_EXPORT"
+fi
+
 # 4) 同步進常駐 mirror（mirror 自己的 .git = 公開端乾淨歷史）
 mkdir -p "$MIRROR_DIR"
 [ -d "$MIRROR_DIR/.git" ] || git -C "$MIRROR_DIR" init -q -b main