ci: add Gitleaks secret-scanning workflow

[CGFixIT]

Summary

Adds .github/workflows/gitleaks.yml — a Gitleaks secret-scanning workflow tailored to CyClaw rather than copied verbatim from the baseline.

This was adapted from the baseline gitleaks.yml in CGFixIT/AzureAI-CopilotStudio-PersonalAgent-Instructions and reshaped to match the conventions already used by CyClaw's security workflows (ci.yml, osv-scanner.yml, codeql.yml, pip-audit.yml).

What it does

• Scans the repo for hardcoded secrets (API keys, tokens, private keys, credentials) on:
  • push to main
  • pull_request targeting main (differential gate before merge)
  • a weekly schedule — Fridays 09:23 UTC
  • manual workflow_dispatch
• Fetches full git history (fetch-depth: 0) so every commit is audited, not just HEAD.

How it's tailored to CyClaw

Concern	Baseline	This PR
Name	CG Gitleaks Secret Scan	CyClaw Gitleaks Secret Scan (matches CyClaw CI, CodeQL Advanced, OSV-Scanner)
Top-level permissions	contents: read	permissions: {} deny-all + per-job least privilege (mirrors osv-scanner.yml)
Action pinning	tag @v2 / @v4	SHA-pinned with # vX.Y.Z comments (mirrors ci.yml/osv-scanner.yml/pip-audit.yml supply-chain convention)
Concurrency	none	gitleaks-… group; superseded runs cancelled, but main history preserved (mirrors ci.yml)
Cron slot	Fri 09:23	kept Fri 09:23 — verified it does not collide with the 6 existing scheduled scanners
Header docs	minimal	CyClaw-style header block explaining intent + threat-model rationale

Pinned versions

• actions/checkout@34e1148… (v4) — the exact SHA already trusted in ci.yml/pip-audit.yml
• gitleaks/gitleaks-action@ff98106… (v2.3.9, latest v2 release)

Notes / decisions

• No paths-ignore — unlike codeql.yml, secret scanning intentionally covers the entire tree (docs/config included), since leaked credentials can appear anywhere.
• Per-job permissions are contents: read (full-history checkout) + pull-requests: write (annotate PR findings). No security-events: write / SARIF upload is added, because gitleaks-action@v2 does not publish to the code-scanning tab by default — this keeps the permission set minimal and matches the baseline behavior.
• GITLEAKS_LICENSE is intentionally omitted — it's only required for GitHub Organization accounts; CGFixIT/CyClaw is a personal account.

Possible follow-up (not in this PR)

If false positives appear (e.g. dummy values like GROK_API_KEY=dummy used in CI, or example endpoints in config.yaml), a .gitleaks.toml allowlist can be added later. It's deliberately omitted here so the default ruleset isn't weakened before we see real signal.

Verification

• YAML parses cleanly (yaml.safe_load).
• Triggers, deny-all top-level permissions, per-job least-privilege, and both pinned SHAs confirmed.

🤖 Generated with Claude Code

---

Generated by Claude Code