Harden gitleaks and lint/format gates

[t4sh]

Summary

• Standardizes the gitleaks workflow on pull requests, all pushes, and manual dispatch.
• Pins GitHub Actions to immutable commit SHAs while retaining source-tag comments.
• Adds optional local pre-commit hooks with gitleaks.
• Skips quality CI because no safe lint/format check with supported install path was detected.

Scope

• Secret scanning baseline: gitleaks.
• Quality gates: lint/format only where non-mutating and reproducible.
• No build, test, type-check, deploy, or preview gates are added.

Quality notes

• no package.json

Follow-up after first green default-branch run

• Enable auto-delete merged branches.
• Require exact discovered gitleaks check name on main.
• Require exact discovered quality check name only if this PR adds .github/workflows/quality.yml.
• Solo repo profile: owner/admin emergency bypass allowed. Shared repo profile: no bypass.