ci: lint and secret-scan pull requests

Add a GitHub Actions workflow that runs the project's pre-commit hooks
against the files changed in each PR, plus a gitleaks secret scan over
the PR's commits. Both block on findings.

Enrich the existing .pre-commit-config.yaml with general hygiene checks
and four linters (shellcheck, yamllint, actionlint, gitleaks), add a
lenient yamllint config tuned for the repo's existing YAML, and add a
gitleaks config that keeps the full default ruleset while baselining the
repo's pre-existing intentional dummy credentials.

Linting is scoped to changed files, so the checks pass on the current
tree and only hold new or edited files to standard.

- .github/workflows/lint.yml: pull_request workflow, read-only token,
  two jobs (pre-commit on changed files + gitleaks on the commit range)
- .pre-commit-config.yaml: keep existing hooks; add hygiene checks,
  shellcheck (--severity=warning), yamllint, actionlint, gitleaks
- .yamllint.yaml: lenient ruleset
- .gitleaks.toml: default rules + allowlist for .env/example placeholders
- .gitleaksignore: baseline of pre-existing intentional dummy credentials

.gitleaks.toml

@@ -0,0 +1,49 @@
+# Gitleaks configuration for JimsGarage.
+#
+# These are homelab tutorial configs: many directories intentionally ship
+# throwaway/dummy credentials so viewers can copy a working example (see
+# issue #127). This config keeps the full default secret-detection ruleset
+# but allowlists the paths and placeholder values that are dummy *by
+# convention*, so the scanner only fires on something that looks like a
+# genuine accidental leak.
+#
+# Tradeoff worth knowing: because `.env` files here are demo placeholders by
+# design, they are allowlisted wholesale — gitleaks will NOT catch a real
+# secret accidentally dropped into a `.env`. The scanner's value in this repo
+# is catching real secrets pasted into scripts, compose files, and manifests.
+
+title = "JimsGarage gitleaks config"
+
+[extend]
+# Inherit all of gitleaks' built-in rules (AWS keys, JWTs, private keys,
+# provider tokens, high-entropy strings, etc.).
+useDefault = true
+
+[[allowlists]]
+description = "Intentional throwaway credentials in example/placeholder files"
+# `paths` is matched against the file path of the candidate finding.
+paths = [
+  # Tracked .env files are demo placeholders by convention in this repo.
+  '''(^|/)\.env$''',
+  '''\.env$''',
+  # Files that are explicitly named as examples/samples/templates.
+  '''(^|/)[^/]*example[^/]*''',
+  '''(^|/)[^/]*sample[^/]*''',
+  '''\.(example|sample|dist|template|tmpl)$''',
+]
+
+[[allowlists]]
+description = "Common placeholder secret values"
+# `regexes` is matched against the detected secret value itself, so a
+# realistic-looking value anywhere still gets flagged — only obvious
+# placeholders are exempted.
+regexTarget = "match"
+regexes = [
+  '''(?i)changeme''',
+  '''(?i)your[-_].*(key|token|secret|password)''',
+  '''(?i)example[-_.]?(key|token|secret|password|value)?''',
+  '''(?i)supersecret''',
+  '''(?i)redacted''',
+  '''(?i)<[^>]+>''',          # angle-bracket placeholders like <your-token>
+  '''(?i)^(test|dummy|placeholder|password|secret)$''',
+]