✨ Enhancement

This change removes two avoidable heap allocations in Rust Guard hot paths used during tool labeling. It keeps behavior unchanged while reducing per-call overhead in get_file_contents secrecy checks and baseline scope inference.

What does this improve?
Lower allocation pressure in frequently executed labeling paths.

Why is this valuable?
These paths run on nearly every label_resource / label_response dispatch, so small per-call savings compound quickly.

Implementation approach:

• check_file_secrecy now uses lazy path iteration (labels/tool_rules.rs)
  • Removed Vec<&str> collection from path_lower.split('/').collect().
  • Replaced segment checks with path_lower.split('/').any(...).
  • Replaced filename extraction via last() with path_lower.rsplit('/').next().
• infer_scope_for_baseline now returns Cow<'_, str> (lib.rs)
  • Switched return type from String to Cow<'_, str>.
  • Common branches now borrow (repo_id, scope_names::GITHUB, and empty scope).
  • Only search_* query extraction returns owned data.
• Focused test updates
  • Added branch-level assertions for Cow::Borrowed/Cow::Owned behavior in infer_scope_for_baseline.

fn infer_scope_for_baseline<'a>(
    tool_name: &str,
    tool_args: &Value,
    repo_id: &'a str,
) -> Cow<'a, str> {
    if !repo_id.is_empty() {
        return Cow::Borrowed(repo_id);
    }

    match tool_name {
        "create_repository" | "fork_repository" => Cow::Borrowed(scope_names::GITHUB),
        "search_code" | "search_issues" | "search_pull_requests" => {
            let query = tool_args.get("query").and_then(|v| v.as_str()).unwrap_or("");
            let (_, _, repo_from_query) = extract_repo_info_from_search_query(query);
            Cow::Owned(repo_from_query)
        }
        _ => Cow::Borrowed(""),
    }
}