fix(security): refine public boundary false positives

[allenwoods]

Summary

Refine three false-positive families in the public repository boundary without weakening the underlying detection:

• keep case-insensitive /Users/... detection and pin reviewed lowercase /users/... API-route fixtures by exact path and whole-file SHA-256;
• keep the full internal-host regex and pin reviewed code-member / migration fixtures by exact path and whole-file SHA-256;
• allow standalone desc.internal locale keys only inside options/locale/ assignments;
• pin the Community Specification's numeric section labels so they are not treated as IP addresses.

Security invariants

• /Users/... and lowercase /users/... real paths still fail.
• db.internal, db.internal.pem, and internal-host assignments outside locale files still fail.
• real public IPv4 addresses still fail.
• every new exemption fails closed after any one-byte content change.

Verification

• 33 focused boundary tests passed.
• 53 complete boundary tests passed.
• the staged public cleanup candidate passes the refined full-tree scan with zero findings.
• independent static security review found no P0/P1/P2 blockers after three initial broad exemptions were replaced with exact hashes.

Guard update exception

This PR intentionally changes a guarded checker file. The immutable pre-push hook and trusted workflow must reject guard changes by default, so the branch was pushed with one audited --no-verify exception and this PR requires an explicit security-admin merge exception. After merge, reinstall the immutable hook from the new default commit before pushing the cleanup branch.