ci(tooling): add gitleaks pre-commit secret scan with __seeds__ allowlist

Blocks commits containing known secret patterns (e.g. Stripe sk_test_*)
before they reach the remote. Exits gracefully with a warning when
gitleaks is not in $PATH so developers who haven't installed it are not
blocked. .gitleaks.toml extends the upstream default ruleset and
allowlists __seeds__/** to prevent false positives from test fixtures.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.husky/pre-commit

@@ -19,3 +19,10 @@ node scripts/work/state-sync-guard.mjs || exit 1
 
 # 4. Check library decision traces for new runtime deps in feature/core packages.
 node scripts/library-decisions/check.mjs || exit 1
+
+# 5. Scan staged changes for secrets (skip gracefully if gitleaks is not installed).
+if command -v gitleaks > /dev/null 2>&1; then
+  gitleaks protect --staged --redact || exit 1
+else
+  echo "gitleaks not found in \$PATH — skipping secret scan (install via brew install gitleaks or https://github.com/gitleaks/gitleaks)"
+fi