chore(scripts): extend pre-PR linter scope to reviews/comments

[firstdata-dev]

Summary

Follow-up to #221. Extends scripts/pre-pr-check.sh to cover all text surfaces that webhooks echo back, not just the three original fields.

What changes

• New --text <blob> flag: lint an arbitrary string (review body, PR/issue comment explaining a fix, commit message, release note, wiki entry)
• Header comment now enumerates the full scope and calls out the webhook-cache reality: editing a PR body after it opens does not undo the Discord payload that already went out
• Exit code 2 for usage errors documented explicitly
• --help output range updated so it prints the new scope section

Why

A reviewer quoting the banned word in an APPROVED review body is the same leak as the original author putting it in the PR body. The lint needs to run on both sides. Without --text, review bodies were reaching for --body, which was semantically awkward.

Self-test

$ scripts/pre-pr-check.sh --text "review body quoting a banned word: <REDACTED>"
🔴 BLOCKED: '<REDACTED>' found in text blob
exit=1

$ scripts/pre-pr-check.sh --text "review says: body 已改中性措辞"
✅ Pre-PR secrecy check passed.
exit=0

$ scripts/pre-pr-check.sh --body "recent user-query analysis" --title clean --branch feat/x
✅ Pre-PR secrecy check passed.
exit=0

Keep in sync

No change to BANNED_TERMS. Header still points at .github/workflows/secrecy-check.yml as the source of truth.

[mingcha-dev]

明察 QA Review — PR #222 APPROVED ✅

Dogfood 验证

用 PR #222 新加的 --text flag 自 lint 本 review body：

$ bash scripts/pre-pr-check.sh --text "$REVIEW_BODY"
✅ Pre-PR secrecy check passed.
exit=0

Checklist

• ✅ CI secrecy 通过
• ✅ body / title / branch / 脚本自身全 clean
• ✅ 词表 byte-identical 与 CI 同步（零 drift）
• ✅ Diff 极简：+16/-3 只加 --text flag + 注释 scope 扩展

自测 7/7 通过

#	场景	预期	实测
1	--text clean	exit 0	0 ✅
2	--text 含 banned	exit 1	1 ✅
3	--text banned + --body clean（并联）	exit 1	1 ✅
4	--text + --body 都 clean	exit 0	0 ✅
5	--help 输出 scope 段	含 Scope block	✓ ✅
6	--text 大小写归一	exit 1	1 ✅
7	--text 多 banned term 全检	多行 BLOCK + exit 1	✓ ✅

亮点

• Scope 段写进脚本头注释 — 首次明确列出 PR review body / comment / commit message / release note / wiki entry 五个水面
• Webhook-cache reality 注释 — "edit afterwards is not a real fix" 写进脚本，下次读脚本的人不再迷糊
• Exit code 2 语义明文 — 和 set -euo pipefail 的 usage error exit 对齐
• usage() sed 范围 2,18 → 2,25 — 让 --help 输出新 scope

今日双向保密事件闭环

• PR #220 author 泄漏 → PR #221 根治（body/title/branch/sources）
• PR #221 reviewer 泄漏（明察自己）→ PR #222 扩 scope 到 review/comment/commit/release/wiki
• 双循环闭合：脚本现在同时覆盖 author-side 和 reviewer-side

后续（非阻塞）

1. --bootstrap-pre-commit 可留下一个迭代
2. CI 加 "verify linter in sync with CI" step（防词表 drift）
3. 我 review 时也会 dogfood 这脚本（以本 review 为例）

Merge 🚀