Redact internal emails from tests and add a CI guard

.github/workflows/no-internal-emails.yml

@@ -0,0 +1,23 @@
+name: no-internal-emails
+
+# Guard against leaking real internal email addresses into a public repo.
+# Tests and fixtures must use RFC 2606 reserved domains (example.com / .org).
+on:
+  push:
+  pull_request:
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Reject @crate.io addresses in tracked files
+        run: |
+          # git grep exits 0 when it finds matches. .github/ is excluded so this
+          # workflow file's own pattern doesn't trip the check.
+          if git grep -n -I -- '@crate.io' -- . ':!.github/'; then
+            echo "::error::Found @crate.io email address(es) in tracked files."
+            echo "Use example.com placeholders in tests and fixtures (public repo)."
+            exit 1
+          fi
+          echo "OK: no @crate.io addresses in tracked files."

tests/test_excel_export.py

@@ -217,7 +217,7 @@ def test_grand_total_uses_per_month_floor(self):
         # One user, one month above the pre-pay and one below. Per-month floor:
         # (800-536) + max(0, 100-536) = 264. Aggregate netting would give
         # max(0, 900 - 2*536) = 0. The grand total must be 264.
-        user = 'x@crate.io'
+        user = 'x@example.com'
         periods = [
             CompensationPeriod(
                 user=user,
@@ -252,14 +252,14 @@ def test_export_succeeds_and_keeps_local_wall_clock(self):
         base = datetime(2026, 4, 6, 18, 0)
         periods = [
             CompensationPeriod(
-                user="walter@crate.io",
+                user="engineer-a@example.com",
                 start=pytz.timezone("Europe/Vienna").localize(base),
                 end=pytz.timezone("Europe/Vienna").localize(base + timedelta(hours=4)),
                 hours=4.0, compensated_hours=4.0, amount=22.84,
                 compensation_type=CompensationType.STANDARD,
             ),
             CompensationPeriod(
-                user="shyukri.shyukriev@crate.io",
+                user="engineer-b@example.com",
                 start=pytz.timezone("Europe/Sofia").localize(base),
                 end=pytz.timezone("Europe/Sofia").localize(base + timedelta(hours=4)),
                 hours=4.0, compensated_hours=4.0, amount=22.84,