fix: audit hardening 2.1.10-SAC — gitignore, SAC TLS warn, Exchange safety

- Extend .gitignore for local settings, logs, spool, backups
- Log CRITICAL when SacTlsSkipVerify is enabled (Login_Monitor + Sac-Client)
- Exchange-MailSecurity: -WhatIf dry-run, scan safety warnings, v1.6.8
- Remove legacy Watchdog_RDP_Monitor.ps1 and Install-ScheduledTasks.ps1
- Add scripts for GitHub sanitize mirror push workflow

scripts/Push-GitHubMirror.ps1

@@ -0,0 +1,39 @@
+# Push sanitized main to GitHub without leaving secrets on local main (kalinamall workflow).
+# Usage: .\scripts\Push-GitHubMirror.ps1
+param(
+    [string]$Remote = 'github',
+    [string]$Branch = 'main'
+)
+
+$ErrorActionPreference = 'Stop'
+$Root = Split-Path -Parent $PSScriptRoot
+Set-Location $Root
+
+git remote get-url $Remote 2>$null | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    throw "remote not configured: $Remote"
+}
+
+if ((git status --porcelain)) {
+    throw 'working tree not clean; commit or stash first'
+}
+
+$before = (git rev-parse HEAD).Trim()
+Write-Output "local HEAD before GitHub push: $before"
+
+& "$PSScriptRoot\Sanitize-ForGitHub.ps1"
+& "$PSScriptRoot\Rewrite-GitHostUrls.ps1" -Target github
+& "$PSScriptRoot\Test-NoSecretsForGitHub.ps1"
+
+$status = git status --porcelain
+if (-not $status) {
+    Write-Output 'no changes after sanitize; pushing current HEAD to GitHub'
+    git push $Remote $Branch
+    exit 0
+}
+
+git add -A
+git commit -m "chore(github): sanitize secrets and sync public mirror URLs"
+git push --force-with-lease $Remote $Branch
+git reset --hard $before
+Write-Output "pushed $Remote/$Branch (force-with-lease mirror); local main restored to $before (production/kalinamall)"