feat(security): add gitleaks secret scanning — this repo had none

An estate-wide audit of secret-scanning coverage found this repository has no
leak detection of any kind: no gitleaks, no trufflehog, nothing.

Measured across all 424 repositories: 170 had gitleaks, 73 had gitleaks plus a
leftover trufflehog step, 33 had trufflehog only, and 88 — this one among them
— had nothing at all.

Adds a caller of the estate's shared secret-scanner reusable, which runs
gitleaks over the whole working tree with --no-git and exits non-zero on a
finding, alongside its rust-secrets and shell-secrets jobs.

Two details that would fail silently if left out:

  - `secrets: inherit` is REQUIRED. Without it the gitleaks action's inner
    secrets.GITHUB_TOKEN is empty and the scan degrades quietly — passing
    while checking less, which is the failure this campaign exists to remove.
  - Where an actions.lock exists it gains a hand-authored [] entry for this
    file. gh actions-lock SKIPS reusable-workflow callers, so without it the
    workflow is rejected as startup_failure with no log and no check run.

Expect findings. A first run on a repository that has never been scanned may
surface real secrets, and any it finds have been exposed for as long as they
have been committed. Treat a red first run as information, not as a fault in
this change — and rotate anything it names rather than only deleting it.

The sweep re-verified from this checkout that no scanner already existed
before writing, rather than trusting the audit that selected the repo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: MPL-2.0
+# Calls the estate's shared secret scanner (gitleaks + rust-secrets +
+# shell-secrets). Added because this repository had NO leak scanning at all.
+#
+# `secrets: inherit` is REQUIRED — without it the gitleaks action's inner
+# secrets.GITHUB_TOKEN is empty and the scan silently degrades.
+name: "Secret Scanner"
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  secret-scan:
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    secrets: inherit