Add secret scanning, layout checks, and a --changed mode

gitleaks runs before each commit and in CI, with known values in a redacted baseline. The layout check rejects empty readmes and main.yml role entrypoints. --changed lints only the YAML files that differ from HEAD.

.pre-commit-config.yaml

@@ -1,6 +1,7 @@
 ---
-# Local hook, same checks as CI. Enable with:
+# Local hooks, same checks as CI. Enable with:
 #   pre-commit install
+#   pre-commit install --hook-type commit-msg
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.6.0
@@ -18,3 +19,15 @@ repos:
     rev: v24.7.0
     hooks:
       - id: ansible-lint
+  - repo: local
+    hooks:
+      - id: gitleaks
+        name: gitleaks
+        entry: scripts/check-secrets.sh --staged
+        language: script
+        pass_filenames: false
+      - id: commit-message
+        name: commit message
+        entry: scripts/check-commit-msg.sh
+        language: script
+        stages: [commit-msg]