chore(security): add repo sentinel hygiene gate

[stacknil]

Summary

• add a narrow repo-sentinel-lite configuration for LogLens
• run repo-sentinel from production PyPI in CI on push, PR, and manual dispatch
• keep the gate focused on repository hygiene and accidental sensitive filenames, with C++ build artifacts ignored

Validation

• repo-sentinel scan --fail-on-severity error --format text .
• cmake -S . -B build\ci-release -D CMAKE_BUILD_TYPE=Release -D BUILD_TESTING=ON
• cmake --build build\ci-release --config Release
• ctest --test-dir build\ci-release --build-config Release --output-on-failure
• git diff --check