Harden repository doctor boundaries

[jjoanna2-debug]

Summary

• Stop the repository doctor from traversing local recovery archives and delegated nested worktrees that are outside the public repository boundary.
• Ignore those local-only areas so they cannot be added accidentally.
• Expand sensitive-filename detection to environment variants, credential manifests, private-key files, and key-container formats.
• Add regression tests for both the traversal boundary and new filename rules.

This makes the security gate evaluate the repository it protects while preserving separate local work without false private-key and secret-assignment failures.

Verification

• cargo fmt --check
• cargo clippy --locked --all-targets -- -D warnings
• cargo test --locked — 7 tests passed
• bash scripts/doctor.sh — passed with preserved nested worktrees present
• npx --yes markdownlint-cli2@0.18.1 CHANGELOG.md — 0 errors
• git diff --check

Risk / Notes

• Public-facing CHANGELOG.md and .gitignore changed.
• The excluded paths are root-only local recovery/delegation areas; nested directories with the same names remain scanned.
• Secret-pattern content scanning remains active everywhere else.
• GitHub branch protection was separately strengthened so administrators must also satisfy the required Repository smoke test; that live setting is outside this commit.