fix(ci): swap gitleaks-action for TruffleHog OSS — gitleaks requires a paid license for org-owned repos

The OSS gitleaks-action exits with `missing gitleaks license` when run
in an org-owned repo (per the action's recent breaking change). The
constraint here is free-tier compatibility, so swap to trufflesecurity/
trufflehog — same diff-focused secret-scan use case, no license check.

Renamed the workflow file gitleaks.yml -> secret-scan.yml so the name
no longer implies the underlying tool.

Author: amacsmith

.github/workflows/gitleaks.yml

@@ -0,0 +1,43 @@
+name: secret-scan
+
+# Diff-focused secret scan via TruffleHog (free for org repos; gitleaks-
+# action requires a paid license for org-owned repos). Complements Socket
+# Security (supply-chain focused, not secret-in-diff focused).
+#
+# On PRs: scans only the commit range between base and head — fast.
+# On push to main: scans full history of the new commits since last push,
+# which is what GitHub passes by default.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: secret-scan-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  trufflehog:
+    name: TruffleHog OSS scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      # pin: v6.0.0 -- actions/checkout
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
+        with:
+          # Full history so the scan can compare base..head (PRs) or walk
+          # the new commits (push). TruffleHog needs both endpoints.
+          fetch-depth: 0
+
+      # pin: v3.95.2 -- trufflesecurity/trufflehog
+      - name: Run TruffleHog
+        uses: trufflesecurity/trufflehog@17456f8c7d042d8c82c9a8ca9e937231f9f42e26
+        with:
+          # `base` is unset on push events; the action computes the
+          # commit range itself in that case. On PR events the action
+          # uses base + head from the event payload.
+          extra_args: --only-verified