feat(security): add gitleaks secret scanning — this repo had none (#47)

An estate-wide audit of secret-scanning coverage found this repository
has no leak detection of any kind: no gitleaks, no trufflehog, nothing.

Measured across all 424 repositories: 170 had gitleaks, 73 had gitleaks
plus a leftover trufflehog step, 33 had trufflehog only, and 88 — this
one among them — had nothing at all.

Adds a caller of the estate's shared secret-scanner reusable, which runs
gitleaks over the whole working tree with --no-git and exits non-zero on
a finding, alongside its rust-secrets and shell-secrets jobs.

Two details that would fail silently if left out:

- `secrets: inherit` is REQUIRED. Without it the gitleaks action's inner
secrets.GITHUB_TOKEN is empty and the scan degrades quietly — passing
while checking less, which is the failure this campaign exists to
remove.
- Where an actions.lock exists it gains a hand-authored [] entry for
this file. gh actions-lock SKIPS reusable-workflow callers, so without
it the workflow is rejected as startup_failure with no log and no check
run.

Expect findings. A first run on a repository that has never been scanned
may surface real secrets, and any it finds have been exposed for as long
as they have been committed. Treat a red first run as information, not
as a fault in this change — and rotate anything it names rather than
only deleting it.

The sweep re-verified from this checkout that no scanner already existed
before writing, rather than trusting the audit that selected the repo.

<!--
SPDX-License-Identifier: CC-BY-SA-4.0
Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-->
## Summary

<!-- What does this PR do, and why? -->

Closes #

## Type of change

- [ ] 🐛 Bug fix (non-breaking change that fixes an issue)
- [ ] ✨ New feature (non-breaking change that adds functionality)
- [ ] 💥 Breaking change (would change existing behaviour)
- [ ] 🕳️ Soundness fix (fixes a checker/proof false-negative)
- [ ] 📖 Documentation
- [ ] 🧹 Refactor / tech debt (behaviour-preserving)
- [ ] ⚡ Performance
- [ ] 🔧 Build / CI / tooling

## How has this been verified?

<!-- Establish ground truth: which tool did you RUN, and what did it
report?
     Don't cite a status doc — cite the command and its output. -->

## Checklist

- [ ] My commits are **signed** (`git commit -S`).
- [ ] I ran the project's own checks/tests locally and they pass.
- [ ] New files carry the correct `SPDX-License-Identifier` (code/config
`MPL-2.0`,
      prose `CC-BY-SA-4.0`); I did not relicense existing files.
- [ ] Docs are updated, and no public claim now overstates what the code
does.
- [ ] I have not introduced a soundness hole (or I have flagged where I
might have).

## Notes for reviewers

<!-- Anything that needs special attention, follow-up, or context. -->

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: MPL-2.0
+# Calls the estate's shared secret scanner (gitleaks + rust-secrets +
+# shell-secrets). Added because this repository had NO leak scanning at all.
+#
+# `secrets: inherit` is REQUIRED — without it the gitleaks action's inner
+# secrets.GITHUB_TOKEN is empty and the scan silently degrades.
+name: "Secret Scanner"
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  secret-scan:
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    secrets: inherit