fix(ci): use gitleaks git --staged in the pre-commit hook

[haribo]

Summary

.githooks/pre-commit called gitleaks detect --staged, but recent gitleaks moved --staged off detect onto gitleaks git. With a current gitleaks the hook errored on flag parsing and blocked every commit, falsely reporting "detected potential secrets" without scanning anything. Switch to gitleaks git --staged.

Test plan

• The fixed hook ran on its own commit (gitleaks git --staged → "no leaks found"), no --no-verify
• Graceful skip when gitleaks is absent is unchanged

Closes #186