Run the secret scan in the local gate, not only in CI #68

Parent

#21

What to build

npm run verify runs the same secret scan CI runs, so a leaked credential is caught on the machine that wrote it rather than after a push.

Today the scan exists only as a CI step that downloads a pinned release of the scanner and runs it over the tree. A contributor running the full gate locally gets no such check, and the command CI runs lives only in the workflow, so nothing keeps the two in step.

• A script wraps the scan, in the shape the other gates use: it takes the binary from an environment variable or from the PATH, returns what it found, and skips loudly when no binary is available rather than passing quietly.
• verify runs that script, and the workflow runs the same script with the pinned binary it downloads, so there is one command and one set of patterns.
• The script is a library first, called in-process by its tests, with one process-level test proving it still runs as a command.

Acceptance criteria

• npm run verify fails on a tree carrying a planted credential, and the failure names the file.
• With no scanner available, the gate prints a skip that says what to install, and exits 0.
• CI invokes the same script rather than its own command line, and still pins the scanner version it downloads.
• A clean tree passes, and a scanner that exits non-zero fails the build.

Blocked by

None (can start immediately).