ci(repo): add gitleaks secret scanning CI gate (#216)

* chore: add gitleaks secret scanning CI gate

Adds a PR-gate + scheduled full-history gitleaks scan. No .gitleaks.toml
needed: a full-history scan of this repo came back clean (zero findings),
so no allowlist tuning required.

* fix: pin gitleaks version instead of resolving latest dynamically

The dynamic lookup (curl api.github.com/.../releases/latest, unauthenticated)
got rate-limited on the runner's shared IP, silently emptied $VERSION, and
tripped `set -e` before printing anything -- reproduced the failure mode
locally. Pinning avoids the extra network call/rate-limit risk entirely and
makes the install step reproducible. Also adds `set -euo pipefail` and `-f`
on curl so any future failure here is loud instead of silent.

* harden: least-privilege permissions, concurrency, checksum-verified install

Addresses review feedback (Copilot on raiko2#147, Claude bot on alethia-reth#216),
verified empirically before applying:

- Add explicit `permissions: contents: read` and a `concurrency` group so
  runs don't pile up on rapid pushes.
- `persist-credentials: false` on checkout -- this job never needs to push.
- Verify the downloaded gitleaks binary against its published SHA256 before
  executing it, instead of trusting an unauthenticated curl download.

Did NOT apply two other review suggestions after testing them directly:
- DeepSeek (taiko-mono#21923) claimed `[allowlist].paths` needs gitignore-glob
  syntax, not regex. Tested locally: a glob pattern crashes gitleaks
  (`regexp: Compile(...): missing argument to repetition operator`). The
  existing regex syntax is correct.
- Claude bot (alethia-reth#216) flagged `--log-opts="BASE..HEAD"` as
  potentially broken. Tested locally with a real commit range: it correctly
  scans exactly the PR's commits, nothing more/less. No change needed.
- Copilot also claimed this repo already pins actions to a commit SHA and
  uses persist-credentials elsewhere -- checked, neither is actually true
  here, so not introducing an inconsistent one-off pinning convention.

Author: kimo-ice

.github/workflows/secret-scan.yml

@@ -0,0 +1,46 @@
+name: "Secret Scan"
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1" # weekly full-history scan, Monday 06:00 UTC
+
+permissions:
+  contents: read
+
+concurrency:
+  group: secret-scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: "8.30.1"
+          GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+        run: |
+          set -euo pipefail
+          curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o gitleaks.tar.gz
+          echo "${GITLEAKS_SHA256}  gitleaks.tar.gz" | sha256sum -c -
+          tar -xzf gitleaks.tar.gz gitleaks
+          sudo mv gitleaks /usr/local/bin/gitleaks
+          gitleaks version
+
+      - name: Scan PR diff
+        if: github.event_name == 'pull_request'
+        run: gitleaks detect --source . --log-opts="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}" --redact --verbose
+
+      - name: Scan full history
+        if: github.event_name != 'pull_request'
+        run: gitleaks detect --source . --redact --verbose