ci: reject live-derived values in commit history

[vkehfdl1]

Summary

• scan every newly introduced commit for non-synthetic Kakao identity fixtures and personal home paths
• fetch full Git history in CI and release jobs
• add a synthetic history-rewrite regression that catches values hidden by a later sanitizing commit

Security context

This is a preventive follow-up to draft advisory GHSA-6gpv-5grw-fv76. No live identifier or conversation content is included in this pull request.

Verification

• rustup run 1.91.0 cargo fmt --all -- --check
• rustup run 1.91.0 cargo clippy --all-targets -- -D warnings
• KATOK_EMBEDDER=local-test rustup run 1.91.0 cargo test --all-targets
• rustup run 1.91.0 cargo publish --dry-run
• python3 scripts/verify_release_config.py
• bash tests/verify_history_privacy.sh
• python3 scripts/verify_history_privacy.py . origin/main..HEAD

All checks passed locally.