ci(security): fail closed on complete-history scans

[halfaipg]

Summary

• replace the working-tree-only scanner with a complete reachable-history scan
• pin checkout and checksum-verify the Gitleaks binary
• prove the scanner rejects a committed synthetic private key
• make infrastructure matching fail closed on regex/execution errors
• acknowledge one exact historical local-development-path fingerprint; no credential finding is suppressed

Verification

• 17 pytest tests passed
• complete 10-commit history scanned clean
• synthetic private-key negative control rejected
• infrastructure-pattern controls passed
• git diff --check clean