chore(security): enforce full-history secret scanning

[beruro]

Problem

ORG2 does not currently run a repository-wide Gitleaks gate. A Gitleaks v8.24.3 scan of the latest develop ancestry reports 22 historical findings, but review of every producing line shows they are limited to two intentionally public Supabase client keys, fourteen dedicated test/snapshot fixtures, and six ordinary identifiers or lockfile values misclassified by generic rules. Without an exact reviewed baseline, enabling the scanner would make every pull request fail and encourage broad rule suppression.

A separate Draft branch for #770 contains a real hardcoded ZenMux credential. That finding is not part of develop, is not allowlisted here, and must remain blocked until the credential is revoked/rotated and the branch is repaired.

Solution

• Add a root .gitleaksignore containing exactly the 22 reviewed develop fingerprints, each bound to its original commit, file, rule, and line.
• Add a Gitleaks secret scan job to pull-request CI using official Gitleaks v8.24.3.
• Fetch full history and scan checked-out HEAD ancestry, covering the target branch and proposed PR commits without letting unrelated stale branch histories block every PR.
• Run with redaction and read-only repository permissions.

The invariant is that reviewed non-secret history is accepted while every new fingerprint, including the #770 credential, still fails CI.

Potential risks

• Fingerprint ignores are experimental, so a future scanner upgrade or history rewrite may require re-baselining reviewed false positives.
• The job scans HEAD ancestry rather than every remote ref. A secret only on an unrelated branch is detected when that branch is proposed; exposed credentials must still be revoked immediately.
• CI gains one Ubuntu job and a pinned-version container pull.
• There is no runtime, dependency, API, storage, or UI change. Rollback is a normal revert of the workflow job and ignore file.

Verification

Validated locally after merging current develop (017fb9afa) into head 3ce1b111b without conflicts:

• Gitleaks v8.24.3 on the merged branch with --log-opts=HEAD --redact — PASS, 3,096 commits / approximately 95.82 MB, no leaks.
• Ruby YAML parser on .github/workflows/ci.yml — PASS.
• Prettier check on .github/workflows/ci.yml — PASS.
• git diff --cached --check before the merge commit — PASS.
• Product tests were not run because this PR changes only CI configuration and its reviewed fingerprint baseline.

Published GitHub CI on head 3ce1b111b is fully green: Gitleaks secret scan, Frontend typecheck/lint/test, Rust clippy, and AI attribution all passed.

Security follow-up

The ZenMux credential on Draft PR #770 must be revoked/rotated outside this PR. Its branch should replace the hardcoded value with an environment- or key-vault-owned lookup, remove the credential from published history, and remain blocked until Gitleaks passes.