Add secret scanning, layout checks, and a --changed mode

gitleaks runs before each commit and in CI, with known values in a redacted baseline. The layout check rejects empty readmes and main.yml role entrypoints. --changed lints only the YAML files that differ from HEAD.

.gitleaks.toml

@@ -0,0 +1,10 @@
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Caches and vendored collections are not repo content"
+paths = [
+  '''\.ansible/''',
+  '''\.scratch/''',
+  '''\.gitleaks-baseline\.json''',
+]