git-filter-repo: History Sanitization

Replace BFG/rebase dance; safe for large repos. DevOps use: scrub .env, keys, or large binaries before open-source release.

git filter-repo --force --path-glob '*.env' --invert-paths
# remove file from all history

git filter-repo --force --path 'secret.key' --invert-paths
# rewrite all refs, then:
git push --force-with-lease origin --all --tags

Post-rewrite: rotate exposed secrets; notify team; verify with git rev-list --objects --all | grep secret.