Add secret scanning, layout checks, and a --changed mode

gitleaks runs before each commit and in CI, with known values in a redacted baseline. The layout check rejects empty readmes and main.yml role entrypoints. --changed lints only the YAML files that differ from HEAD.

AGENTS.md

@@ -3,14 +3,18 @@
 This repository holds one Ansible playbook per service. Read
 [CODING_STANDARDS.md](CODING_STANDARDS.md) before adding or changing a playbook.
 
-- Layout and naming: [CODING_STANDARDS.md](CODING_STANDARDS.md).
-- Checks: run `./scripts/check.sh`. It runs yamllint, ansible-lint, and a syntax
-  check on every `*/playbook.yml`. CI runs the same script.
+- Checks: run `./scripts/check.sh`. Add `--changed` while iterating to lint only
+  the YAML files that differ from HEAD. CI runs the full script.
 - Review baseline: `origin/main`. The review diff is `git diff origin/main...HEAD`.
 - Migration spec: [docs/podman-migration.md](docs/podman-migration.md). Section 8
   lists the repo changes the migration expects.
 - Issue tracker: [docs/agents/issue-tracker.md](docs/agents/issue-tracker.md).
 - Scratch files: write them under `.scratch/`. It is git-ignored, and `/tmp` is
   wiped between tool calls in this environment.
-- Secrets: `vars/default.yml` holds deploy values, including passwords. Do not
-  copy a production value into a file you push to a public remote.
+- Read-only `$HOME`: if `$HOME` is read-only, point `XDG_CACHE_HOME`,
+  `UV_CACHE_DIR`, `PIP_CACHE_DIR`, and `ANSIBLE_HOME` under `.scratch/`. The check
+  script already does this, and a vault password file has to live there too.
+- Secrets: `vars/default.yml` holds deploy values, including passwords. gitleaks
+  runs before each commit and in CI. Known values are in
+  [.gitleaks-baseline.json](.gitleaks-baseline.json); rotate or vault a value
+  instead of adding a new entry.