feat: add gitleaks secret scanning setup and skill

- scripts/setup-gitleaks.sh — installs gitleaks v8.24.2, seeds
  .gitleaks.toml on first run, writes managed pre-commit hook block;
  re-run replaces block in place without disturbing other hook content
- scripts/gitleaks.toml — base config template extending default ruleset
- .gitleaks.toml — repo config with docs/research/ path allowlist
  (high-entropy terminal captures; v8.24.2 [allowlist] syntax)
- tests/test-setup-gitleaks.sh — 6 behavior tests including stale-block
  replacement and idempotency
- .agents/skills/gitleaks/ — cross-cutting skill covering install,
  update, allowlist tuning, scan modes, and real-finding remediation
- .agents/evals/cross-cutting/gitleaks/eval.yaml — 7 trigger + 3 output
  tests including version-aware allowlist guidance case
- docs/spec/overview.md — updated to reflect new tooling and skill

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitleaks.toml

@@ -0,0 +1,27 @@
+title = "gitleaks config"
+
+[extend]
+# Extends the default ruleset built into gitleaks.
+# Remove useDefault and define [[rules]] from scratch if you want full control.
+useDefault = true
+
+# Rules to disable from the default set — uncomment and add IDs for known false positives.
+# Run `gitleaks git -v` on your repo first to discover which rules fire.
+# disabledRules = ["generic-api-key"]
+
+# Project-specific allowlists — entries here apply to all rules.
+# Add fingerprints from .gitleaksignore, or path/regex patterns to suppress noise.
+#
+# Example: ignore test fixtures
+# [[allowlists]]
+# description = "test fixtures"
+# paths = ['''tests/fixtures/.*''']
+#
+# Example: ignore a known false-positive secret value
+# [[allowlists]]
+# description = "placeholder values used in docs"
+# stopwords = ["example", "placeholder", "changeme"]
+
+[allowlist]
+description = "research session notes — no secrets, high-entropy text from terminal captures"
+paths = ['''docs/research/.*''']