Add secret scanning, layout checks, and a --changed mode

gitleaks runs before each commit and in CI, with known values in a redacted baseline. The layout check rejects empty readmes and main.yml role entrypoints. --changed lints only the YAML files that differ from HEAD.

scripts/check-secrets.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Scan for secrets. Known values are listed in the redacted baseline.
+# Usage: scripts/check-secrets.sh [--staged]
+set -euo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+version="8.30.1"
+bin="$PWD/.scratch/bin/gitleaks"
+
+if ! command -v gitleaks >/dev/null 2>&1; then
+  if [ ! -x "$bin" ]; then
+    case "$(uname -m)" in
+      x86_64|amd64) arch=x64 ;;
+      aarch64|arm64) arch=arm64 ;;
+      *)
+        echo "unsupported architecture: $(uname -m)" >&2
+        exit 1
+        ;;
+    esac
+    echo "installing gitleaks $version into .scratch/bin" >&2
+    mkdir -p .scratch/bin
+    curl -fsSL -o .scratch/bin/gitleaks.tar.gz \
+      "https://github.com/gitleaks/gitleaks/releases/download/v${version}/gitleaks_${version}_linux_${arch}.tar.gz"
+    tar -xzf .scratch/bin/gitleaks.tar.gz -C .scratch/bin gitleaks
+  fi
+  PATH="$PWD/.scratch/bin:$PATH"
+fi
+
+if [ "${1:-}" = "--staged" ]; then
+  gitleaks git --pre-commit --staged --redact --verbose \
+    --baseline-path .gitleaks-baseline.json
+else
+  gitleaks git --baseline-path .gitleaks-baseline.json --redact --no-banner
+fi