Avoid secret scan file race

[Mandal-OS]

Summary

• Avoid the stat-then-read pattern in scripts/check-secrets.mjs that CodeQL flagged as a file-system race.
• Read the file first, then skip large buffers before text/secret scanning.

Verification

• npm run check
• npm audit --audit-level=low
• node --check scripts/check-secrets.mjs

Risk Review

• Security: addresses a CodeQL warning in the secret scanner.
• Performance: still skips buffers larger than 1 MB before regex scanning.
• Operations: no workflow changes.