fix(ci): scope Gitleaks to checked-out history - #106

Summary

Closes #105.

• Scope required Gitleaks scans for pull requests and pushes to commits reachable from the checked-out HEAD, instead of every unrelated ref fetched into the repository.
• Retain repository-wide --all audits for scheduled and manually dispatched runs; unknown future event types also default to the wider audit.
• Preserve Gitleaks v8.30.0's existing --full-history and --diff-filter=tuxdb behavior, terminate revision parsing with --, and keep the pinned image digest unchanged.
• Fail closed before scanning if checkout history is shallow or HEAD is not a valid commit. This matters because v8.30.0 can log an invalid-revision error while still returning exit code 0.
• Add workflow regression coverage for both exact scan scopes, their event mapping, shell quoting, checkout depth, trigger set, and the pinned Gitleaks image.

For pull requests, GitHub's checked-out merge ref includes base ancestry and all PR commits. Pushes to main scan the full main ancestry. Scheduled and manual runs retain the pre-PR repository-wide audit across fetched branches and tags.

Verification

• I am familiar with the Contributing Guidelines
• Added or updated focused tests
• Updated documentation for user-visible changes — not applicable; this is CI-only
• Ran make lint
• Ran make test — see full-suite environment result below
• Ran make build
• Did not add credentials, private datasets, or proprietary benchmark content

Focused and static verification:

• uv run pytest -q tests/test_ci_workflows.py — 11 passed
• make PYTHON=.venv/bin/python lint — passed
• make PYTHON=.venv/bin/python build — passed
• Linux full suite — 5122 passed, 51 skipped, 4 deselected; two host-only failures because /usr/bin/codex was installed and port 18080 was already occupied. Neither failing test intersects this diff.

Pinned-image behavioral verification:

• Real full clone with 20 branch/tag refs: HEAD scope scanned 65 commits, exited 0, and found no leaks; --all scanned 179 commits and detected the existing fixtures on other refs, confirming that scheduled/manual audit coverage is retained.
• Synthetic finding on an unrelated branch: HEAD scope exits 0 while all-ref scope exits 1.
• Synthetic finding on current history: HEAD scope exits 1.
• Synthetic finding in an older current-branch commit, removed before HEAD: HEAD scope still exits 1.
• A root path named HEAD remains unambiguous because the revision list ends with --.

Release Impact

• No user-visible release note needed
• Updated CHANGELOG.md