Check the staged diff for credentials before push commits

`push` runs `git add --all .`, so anything lying in the project gets
committed, and with `mirror = true` it reaches a public server in the
same breath. It is the one action in mgsh that cannot be undone: a
deleted server repository comes back from an archive, a published
credential does not.

The staged diff is now scanned before the commit is made -- private keys,
GitHub/GitLab/Slack/AWS/PyPI tokens, and credential-shaped assignments --
and a hit is shown with file and line before asking whether to continue.
Declining leaves the changes staged but uncommitted, so removing the file
and adding a .gitignore entry is all it takes.

The hard part is not detection but silence. A scanner that cries wolf
gets answered with a reflexive "y" and stops being a safety net, so
values that are plainly environment references, dotted identifiers,
constant names, template slots or masked stand-ins are filtered out. A
test scans mgsh's own README and mgshrc.example -- both full of
credential-shaped text -- and fails if either would trip the check. It
caught the documentation for this very feature, which is why the README
describes the sample output instead of reproducing it.

For a line that legitimately looks like a credential there is
`mgsh:allow`, which suppresses that one line; `secretscan = off` turns
the check off entirely. Only an explicit "off" does that -- a typo in the
setting leaves the safety net in place, which is what the new falsy()
is for.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

commands.go

@@ -272,6 +272,13 @@ func runCommandDepth(line string, depth int) bool {
 		}
 		comment := strings.Join(fields[1:], " ")
 		git(DIR, "add", "--all", ".")
+		// last look before anything is committed: `add --all` sweeps up whatever
+		// is lying around, and with mirroring on it goes straight to a public
+		// server. Nothing has been committed yet, so declining costs nothing.
+		if !secretsApproved(DIR) {
+			errorln("push cancelled — your changes are staged but not committed")
+			break
+		}
 		msg := strings.TrimSpace(fmt.Sprintf("[%s@%s] %s", USER, HOST, comment))
 		git(DIR, "commit", "-m", msg) // may be "nothing to commit"; continue anyway
 		if !gitOK(DIR, "push") {
@@ -711,7 +718,7 @@ var helpItems = []struct{ cmd, desc string }{
 	{"pull", "pull changes from git server"},
 	{"fetch", "fetch changes from git server"},
 	{"status [-a]", "short git status (-a: overview of all projects)"},
-	{"overview", "status of all projects (dirty, ahead/behind)"},
+	{"overview", "inventory of all projects, local and on the server"},
 	{"diff [args]", "show git diff"},
 	{"edit [number]", "edit last [number] commits (default is 10)"},
 	{"clone [-a] <repository>", "clone repository from git server (-a for archive)"},