feat: add 10-year long-tenure loyalty discount

[shubhamseervi]

Summary

Adds a new 10-year long-tenure loyalty bracket (15%) on top of the existing
1/3/5-year loyalty tiers in the quote engine. Members who have stayed 10+ years
are the lowest-churn, lowest-claims-frequency cohort and earn the deepest
loyalty discount.

Changes

• src/discount.ts — new >= 10 years -> 0.15 bracket in loyaltyDiscountRate.
• test/discount.test.ts — covers the new bracket (rate table + loyaltyDiscount).
• test/quote.test.ts — the deepest-discount case now exercises the regulatory
  premium floor (previously unreachable), so the clamp is now under test.

Testing

• npm run lint — clean
• npm test -- --coverage — 40 tests pass, 100% coverage
• npm run build — clean

Closes PRU-123

Summary by CodeRabbit

• New Features
  • Added a new loyalty discount tier for customers with 10+ loyalty years (15% rate).
• Bug Fixes
  • Updated quote calculations to clamp “deeply discounted” quotes to the regulatory minimum.
  • Added a visible “Regulatory floor adjustment” line item when the minimum premium applies.
• Documentation
  • Updated loyalty discount documentation to include the 10+ years tier.
• Tests
  • Revised discount and quote test cases to match the updated tiering and minimum-premium behavior.
• Chores
  • Updated repository leak-scanning workflow to use a pinned binary.
  • Updated code ownership for the quote-engine service.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: df60657e-db8b-4963-807e-e2feb718ecd1

📥 Commits

Reviewing files that changed from the base of the PR and between 41ba04a and 3302811.

📒 Files selected for processing (1)

• .github/CODEOWNERS

---

Walkthrough

src/discount.ts adds a new loyaltyYears >= 10 return of 0.15 and updates the bracket documentation. test/discount.test.ts changes the rate table and adds a 10-year discount case. test/quote.test.ts now expects calculateQuote to clamp to PREMIUM_FLOOR and include a "Regulatory floor adjustment" line item. .github/workflows/gitleaks.yml now downloads and runs a pinned gitleaks binary instead of the action. \.github/CODEOWNERS updates the owner for quote-engine-svc.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding a new 10-year loyalty discount bracket.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/gitleaks.yml:
- Around line 17-20: The gitleaks install step currently extracts the downloaded
release tarball without verifying its integrity. Update the workflow step in
gitleaks.yml to fetch the published checksum file for the same VERSION, verify
the downloaded gitleaks_${VERSION}_linux_x64.tar.gz against it before calling
tar, and only proceed to ./gitleaks version and ./gitleaks detect after the
checksum matches.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6b336bf7-c74f-4f25-a801-80dad58156ab

📥 Commits

Reviewing files that changed from the base of the PR and between de1704a and e991df8.

📒 Files selected for processing (1)

• .github/workflows/gitleaks.yml