ci: add secret scanning

[zgeoff]

Adds the org secret scanning workflow, calling the reusable gitleaks scan in pipelabs/tooling, per the secrets hygiene guideline. It scans commits introduced by PRs and pushes, not existing history. After merge, secret-scan / gitleaks becomes a required status check on main, which also means direct pushes to that branch will be blocked in favour of PRs.

Also adds lefthook with a prepare script so pre-commit secret scanning installs on the next dependency install (each dev needs brew install gitleaks once).

[cursor]

PR Summary

Low Risk
Changes are limited to CI and developer git hooks; no application runtime, auth, or data-path code is modified.

Overview
Adds CI secret scanning on pull requests and pushes to main via a new .github/workflows/security.yml job that reuses pipelabs/tooling/.github/workflows/secret-scan.yml@main (gitleaks on new commits).

Adds local pre-commit secret checks by introducing lefthook (lefthook.yml pulls lefthook/security.yml from pipelabs/tooling), a prepare script (lefthook install --force || true), and the lefthook@2.1.4 devDependency (with lockfile updates).

^{Reviewed by Cursor Bugbot for commit 462c315. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 462c315. Configure here.}

[cursor]

Windows prepare ignore fails

Low Severity

The new prepare script uses || true so a failed lefthook install does not break dependency install. On Windows, npm/yarn run scripts via cmd.exe, where true is not a command, so when install fails the ignore path fails too and yarn install exits non-zero. This repo’s prerequisites steer Windows users to Command Prompt, not Git Bash.

 

^{Reviewed by Cursor Bugbot for commit 462c315. Configure here.}