chore: add gitleaks secret-scan (CI action + opt-in pre-commit hook)