ci: lint and secret-scan pull requests

Add a GitHub Actions workflow that runs the project's pre-commit hooks
against the files changed in each PR, plus a gitleaks secret scan over
the PR's commits. Both block on findings.

Enrich the existing .pre-commit-config.yaml with general hygiene checks
and four linters (shellcheck, yamllint, actionlint, gitleaks), add a
lenient yamllint config tuned for the repo's existing YAML, and add a
gitleaks config that keeps the full default ruleset while baselining the
repo's pre-existing intentional dummy credentials.

Linting is scoped to changed files, so the checks pass on the current
tree and only hold new or edited files to standard.

- .github/workflows/lint.yml: pull_request workflow, read-only token,
  two jobs (pre-commit on changed files + gitleaks on the commit range)
- .pre-commit-config.yaml: keep existing hooks; add hygiene checks,
  shellcheck (--severity=warning), yamllint, actionlint, gitleaks
- .yamllint.yaml: lenient ruleset
- .gitleaks.toml: default rules + allowlist for .env/example placeholders
- .gitleaksignore: baseline of pre-existing intentional dummy credentials

.pre-commit-config.yaml

@@ -1,13 +1,40 @@
 ---
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.5.0
+    rev: v5.0.0
     hooks:
+      # Pre-existing checks
       - id: check-symlinks
       - id: destroyed-symlinks
       - id: detect-aws-credentials
         args: [--allow-missing-credentials]
+      # General hygiene
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-merge-conflict
+      - id: check-added-large-files
+      - id: mixed-line-ending
+      - id: check-yaml
+        args: [--allow-multiple-documents]
   - repo: https://github.com/IamTheFij/docker-pre-commit
     rev: v3.0.1
     hooks:
       - id: docker-compose-check
+  - repo: https://github.com/koalaman/shellcheck-precommit
+    rev: v0.10.0
+    hooks:
+      - id: shellcheck
+        # Block on real warnings/errors; skip style/info noise on legacy scripts.
+        args: [--severity=warning]
+  - repo: https://github.com/adrienverge/yamllint
+    rev: v1.35.1
+    hooks:
+      - id: yamllint
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.7
+    hooks:
+      - id: actionlint
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks