ci: allowlist hook fixtures for gitleaks and GitGuardian

The secret-scanner fixtures carry deliberately fake AWS/GitHub-shaped tokens so
the hook has something to catch. Path-based allowlisting via .gitleaks.toml (the
.gitleaksignore path entries were invalid — gitleaks expects fingerprints) and a
.gitguardian.yaml ignored-paths entry so both scanners skip them.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: aram-devdocs

.gitguardian.yaml

@@ -0,0 +1,8 @@
+version: 2
+
+# The hook fixtures under .claude/hooks/fixtures/ carry deliberately fake
+# AWS/GitHub-shaped tokens so the secret-scanner hook has something to catch.
+# They are not real credentials — exclude them from secret scanning.
+secret:
+  ignored-paths:
+    - ".claude/hooks/fixtures/**"

.gitleaks.toml

@@ -0,0 +1,12 @@
+title = "GoudEngine gitleaks config"
+
+# Use the full default gitleaks ruleset, then allowlist the intentional test
+# fixtures below.
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Hook fixtures carry deliberately fake AWS/GitHub-shaped tokens to exercise the secret-scanner hook; they are not real credentials."
+paths = [
+    '''\.claude/hooks/fixtures/.*''',
+]

.gitleaksignore

@@ -1,9 +1,5 @@
-# Allowlist for gitleaks. Each entry is a fingerprint (commit:path:rule:line)
-# or a path/rule the scanner should ignore. Add only vetted false positives —
-# test fixtures with fake credentials, documentation examples — never real
-# secrets. Keep each entry commented with why it is safe.
-
-# Hook fixtures deliberately contain fake AWS/GitHub-shaped tokens to exercise
-# the secret-scanner; they are not real credentials.
-.claude/hooks/fixtures/secret-scanner/write-secret.expect2.json
-.claude/hooks/fixtures/secret-scanner/multiedit-secret.expect2.json
+# gitleaks fingerprint allowlist (commit:path:rule:line entries).
+#
+# Path-based allowlisting for the intentional hook fixtures lives in
+# .gitleaks.toml ([allowlist].paths) instead, which is stable across commits.
+# Add fingerprints here only for one-off vetted findings.