sec(ci): decide whether to run gitleaks in CI #73

Follow-up from #13 (closed by #70). Item 3 of #13's acceptance criteria asks for a decision on whether to wire gitleaks into this repo's CI. #70 deliberately left that as an owner question.

Current state, checked on #70's head:

• No workflow, script or Makefile target invokes gitleaks.
• .gitleaksignore was deleted. Its only entry was a bare path to a file that no longer exists.
• Secret scanning runs through pre-commit (detect-private-key) and git-secrets.

If gitleaks is wired in, a local gitleaks detect --no-git run reports two generic-api-key hits, and both would need fingerprint allowlisting:

• .github/workflows/pre-commit.yml:108
• tools/archera_error_mask_test.go:16 (the synthetic test-key-SYNTHETIC-0000)

Decision needed: wire gitleaks into CI (with fingerprint-based allowlist entries), or record that pre-commit and git-secrets coverage is enough and close this.