feat: add gitleaks secret scanning setup and skill
- scripts/setup-gitleaks.sh — installs gitleaks v8.24.2, seeds
.gitleaks.toml on first run, writes managed pre-commit hook block;
re-run replaces block in place without disturbing other hook content
- scripts/gitleaks.toml — base config template extending default ruleset
- .gitleaks.toml — repo config with docs/research/ path allowlist
(high-entropy terminal captures; v8.24.2 [allowlist] syntax)
- tests/test-setup-gitleaks.sh — 6 behavior tests including stale-block
replacement and idempotency
- .agents/skills/gitleaks/ — cross-cutting skill covering install,
update, allowlist tuning, scan modes, and real-finding remediation
- .agents/evals/cross-cutting/gitleaks/eval.yaml — 7 trigger + 3 output
tests including version-aware allowlist guidance case
- docs/spec/overview.md — updated to reflect new tooling and skill
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Defame1297
25a6a454b9