feat(security): add gitleaks secret scan to lefthook pre-commit

[iap]

Summary

• Add — gitleaks-based secret scan
• Wire it into as a command (skips merge/rebase)
• Document the new hook in

Why

Prevent accidental secret commits. Gitleaks scans staged files before commit and blocks if secrets are detected.

Verification

• passes
• 7/7 ad-hoc checks passed (syntax, YAML validity, gitleaks detection confirmed with RSA private key test)

Greptile Summary

Adds a pre-commit secret scanner and documents installation of its required tooling. The earlier documentation concern is resolved: the setup now installs Gitleaks before hooks are installed, and an executed check confirmed the required command is documented.

Confidence Score: 5/5

No blocking failure remains.

The hook accepted harmless content, rejected a detectable fake credential, and the documentation includes the required Gitleaks installation command.

T-Rex Logs

What T-Rex did

• The secret-scan wrapper was run with a harmless fixture in an isolated worktree, and it reported no leaks with exit code 0.
• The same wrapper was run with a staged fake Slack token, and it exited with code 1 with gitleaks reporting slack-bot-token.
• The README documents the installation commands mise use lefthook and mise use gitleaks, ensuring the required executable is available for the wrapper.

_{Ran code and verified through T-Rex}

_{Reviews (2): Last reviewed commit: "fix(README): add gitleaks installation s..." | Re-trigger Greptile}