Add buildscripts/private/check_public_commit.py to audit all parents of retained public MongoDB PRs for exact private commit hashes and historically excluded file changes. Unreviewed SHA matches fail CI even without excluded-content changes. Exclude mirrored history, verified Copybara exports, and exact reviewed SHA exceptions; continue searching across all parents.

Consolidate fork-owner checking in buildscripts/private/monitor_public_mongo.py. Generate a private Markdown attachment listing SHA findings, known content, and informational path-only matches with commit links and ancestry distances. Display SHA and content counts in a compact results box. Upload reports before enforcing failures.

Validation: 103 tests, Bazel lint, and formatting passed. Scanning passed with three reviewed matches.