Jupyter notebook output stripper and CI check

Notebooks are where most AI experiments start, and their outputs are where data leaks: printed API responses, sample customer records, tokens echoed by a debug cell, or megabytes of embeddings that bloat the repository and make diffs unreadable. This script removes outputs before commit, and the workflow makes sure nobody forgets.

**Two modes**

- `--check` reports notebooks with outputs, execution counts or volatile cell metadata and exits 1. Nothing is changed. This is what CI runs. - `--fix` clears them and rewrites the files.

**What `--fix` changes**

For each code cell: `outputs` becomes `[]`, `execution_count` becomes `null`, and the volatile metadata keys `execution`, `collapsed`, `scrolled` and `ExecuteTime` are removed (keep them with `--keep-metadata`). Markdown cells, raw cells, cell sources and notebook-level metadata such as the kernel spec are untouched. Files are written with one-space JSON indentation, the same format Jupyter uses, so the diff shows only the removed outputs.

**Example**

``` $ python3 scripts/strip_notebooks.py --check experiments/rag-eval.ipynb: 7 code cell(s) with outputs or execution data

1 notebook(s) need stripping. Run: python3 scripts/strip_notebooks.py --fix $ python3 scripts/strip_notebooks.py --fix stripped experiments/rag-eval.ipynb (7 cell(s)) ```

**What it will not do**

- Remove secrets from cell **source**. A hardcoded key in code stays there; pair this with a secret scanner. - Rewrite git history. Outputs already pushed remain in earlier commits. - Handle notebook formats older than nbformat 4.

If your team needs outputs in some notebooks (for example, published tutorials), keep those in a separate folder and pass only the experiment folders to the check.

Exit codes: 0 clean or fixed, 1 `--check` found outputs, 2 unreadable file or not a notebook.