feat(ci): add gitleaks PR-gating + base allowlist (Phase 0.B1-fleet)

Adds a Secret Scan workflow that runs gitleaks against every PR and
push to default branch. Mirrors the canonical pattern in BfxLendingBot,
BfxPingPongBot, and the Wave-1 repos (BotEventAggregator, Knowledge-Hub,
DigiConta, blazor-shared, infra-iac).

This is Wave 2 of the Phase 0.B1-fleet rollout — the 6 repos that didn't
yet have a `gitleaks.toml`. CI-style scan (`--log-opts="--no-merges -1"`)
on current HEAD reports `no leaks found` against gitleaks default rules,
so the toml ships as a minimal scaffold (extend `paths` / add `regexes`
if findings surface).

Phase 0 of the Restart-2026-04 master plan requires zero secret-leak
findings across all fleet repos before the bot fleet restarts on Opus
4.7. Pre-PR gating catches hardcoded secrets before they merge to
master/main.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: JCBauza

.github/workflows/secret-scan.yml

@@ -0,0 +1,40 @@
+name: Secret Scan
+
+# Mirrors the BfxLendingBot / BfxPingPongBot pattern:
+# Gitleaks PR-gating runs on every PR + every push to default branch
+# to catch hardcoded secrets before merge. Uses repo-local gitleaks.toml
+# for allowlist (extends gitleaks default rules with paths/regexes for
+# this repo's known false positives).
+#
+# Phase 0.B1-fleet rollout (Restart-2026-04 master plan).
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+    branches: [master, main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: secret-scan-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gitleaks:
+    name: Secret Scan
+    runs-on: [self-hosted, Linux, Build]
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Gitleaks — secret scanning
+        run: |
+          GITLEAKS_VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | grep tag_name | cut -d '"' -f4 | sed 's/^v//')
+          mkdir -p "$HOME/.local/bin"
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C "$HOME/.local/bin" gitleaks
+          "$HOME/.local/bin/gitleaks" detect --source . --config gitleaks.toml --log-opts="--no-merges -1" --verbose --redact --no-banner

gitleaks.toml

@@ -0,0 +1,20 @@
+# =============================================================================
+# Gitleaks Configuration
+# =============================================================================
+# Mirrors the BfxLendingBot pattern: useDefault rules + minimal path
+# allowlist. Currently no false positives on this repo's working tree;
+# extend `paths` or add `regexes` here if findings surface in CI.
+# =============================================================================
+
+[extend]
+useDefault = true
+
+[allowlist]
+  description = "Global allowlist"
+  paths = [
+    # Standard ignores
+    '''\.gitleaksignore''',
+    '''\.env\.example''',
+    '''\.env\.local''',
+  ]
+  regexTarget = "line"