test(10-09): add end-to-end SweepAll integration test across all ten sources

.planning/phases/10-osint-code-hosting/deferred-items.md

@@ -0,0 +1,13 @@
+# Phase 10 — Deferred Items
+
+Out-of-scope findings discovered during plan execution. These are NOT fixed in
+the current plan but are tracked here for future work.
+
+## 10-09
+
+- **GitHubSource struct-literal panic risk.** `GitHubSource.Sweep` dereferences
+  `s.client` without a nil check (pkg/recon/sources/github.go:106). `NewGitHubSource`
+  initializes `client`, so `RegisterAll` is safe, but any future caller using a
+  struct literal (as sibling sources do) will panic. Fix: add
+  `if s.client == nil { s.client = NewClient() }` at the top of Sweep. Siblings
+  (GitLab, Bitbucket, Gist, Codeberg, HuggingFace, Kaggle) already lazy-init.