Add secret scanning, layout checks, and a --changed mode

gitleaks runs before each commit and in CI, with known values in a redacted baseline. The layout check rejects empty readmes and main.yml role entrypoints. --changed lints only the YAML files that differ from HEAD.

scripts/check-commit-msg.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Reject placeholder commit subjects. pre-commit passes the message file.
+set -euo pipefail
+
+message_file="$1"
+subject=$(head -n 1 "$message_file")
+
+if [ -z "${subject//[[:space:]]/}" ]; then
+  echo "commit subject is empty" >&2
+  exit 1
+fi
+
+case "${subject,,}" in
+  misc|misc.|wip|wip.|update|updates|fix|fixes|change|changes|stuff|temp|tmp)
+    echo "commit subject is a placeholder: '$subject'" >&2
+    exit 1
+    ;;
+esac
+
+exit 0