[security]: add secret scanning guardrail

[pschork]

Summary

• Adds a Secret Scan workflow that runs gitleaks on PRs and pushes to master.
• Adds a repo-local gitleaks rule for Exa API key assignments, including EXA_API_KEY and EXASEARCH_API_KEY.
• Broadens .gitignore coverage for env files while keeping .env.example allowed.

Review & Testing Checklist for Human

• Confirm GitHub Actions runs the new Secret Scan workflow on this PR.
• Confirm the exposed API key from SEC-36 has been revoked or rotated outside this repo.
• Decide whether public git history should be rewritten or whether rotation plus CI guardrails is sufficient.

Notes

• Current master does not contain .env; the reported key is still present in old public commit history (fc68f05).
• Local checks: docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:v8.28.0 detect --source=/repo --no-git --config=/repo/gitleaks.toml --redact --verbose, npm run build, npm run typecheck:examples, npm run test:unit.
• npm run typecheck currently fails on examples/zod_summary_example.ts, and full npm test currently fails in the live API Company Category Search integration test; both appear unrelated to this PR.

Link to Devin session: https://app.devin.ai/sessions/d2bd2ab8af2f4cababf923951e82fd6c
Requested by: @pschork

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[linear]

SEC-36