chore(security): add optional Trivy pre-commit scan

[t4sh]

Summary

• add an optional local Trivy filesystem scan wrapper
• wire it into pre-commit without blocking developers who do not have Trivy installed
• scan vulnerabilities and misconfigurations only; gitleaks remains responsible for secrets

Validation

• wrapper scripts compile with Python
• pre-commit YAML parsed successfully locally