GeezerVison

The public privacy test embedded an internal repository inventory, and the existing profile tests had no CI workflow. Replace the embedded names with optional PROFILE_PRIVATE_REPO_DENYLIST input and always check organization repository links against the existing public allowlist. Failures omit rejected names. Add Linux, Windows and macOS CI for the existing parity suite and synthetic guard checks. The optional secret is not required for fork runs; without it, no private-name inventory check is claimed. Validation: unchanged base 12 tests passed; changed suite 17 passed; git diff --check passed. Only tests and the new workflow change. Historical Git content and other assets are not certified clean. No product, release or profile deployment. Author model: gpt-6.1-sol (Codex). Independent model review and exact-head CI pending. Draft; merges disabled.