chore(sdlc): harden ci/cd safety nets

Author: Aitomates

.github/dependabot.yml

@@ -4,3 +4,7 @@ updates:
     directory: "/."
     schedule:
       interval: "weekly"
+    groups:
+      all:
+        patterns:
+          - "*"

.github/pull_request_template.md

@@ -1,11 +1,8 @@
-## Outcome
-
-## Security and operational impact
-
-## Validation
-
-- [ ] `./scripts/validate.ps1`
-- [ ] Azure what-if reviewed when infrastructure behavior changes
-- [ ] No secrets or tenant-specific values committed
-- [ ] Documentation and threat model updated
-
+## Description
+<!-- Describe your changes -->
+
+## SDLC Verification
+- [ ] Code follows CAS architecture (`AGENTS.md`)
+- [ ] Tested via `gsd-verify-work`
+- [ ] No embedded secrets or credentials
+- [ ] Passed `gsd-code-review`

.pre-commit-config.yaml

@@ -1,6 +1,14 @@
 repos:
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.4.0
+-   repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
     hooks:
-      - id: trailing-whitespace
-      - id: end-of-file-fixer
+    -   id: trailing-whitespace
+    -   id: end-of-file-fixer
+    -   id: check-merge-conflict
+    -   id: check-yaml
+    -   id: check-json
+    -   id: check-added-large-files
+-   repo: https://github.com/gitleaks/gitleaks
+    rev: v8.18.2
+    hooks:
+    -   id: gitleaks