feat: add lefthook pre-commit hook with gitleaks secret scanning

.gitleaks.toml

@@ -0,0 +1,15 @@
+title = "entity gitleaks config"
+
+# Start from gitleaks' maintained default ruleset and layer an allowlist
+# on top for this repo's known false positives, per the Git Hooks RFC:
+# https://github.com/bcgov/connect/discussions/23
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Files that routinely trip default rules with non-secret content"
+paths = [
+  '''pnpm-lock\.yaml''',
+  '''package-lock\.json''',
+  '''\.gitleaks\.toml''',
+]

lefthook.yml

@@ -0,0 +1,9 @@
+# Lefthook Git hooks configuration
+# https://github.com/evilmartians/lefthook
+
+pre-commit:
+  parallel: true
+  commands:
+    secret-scan:
+      tags: security
+      run: npx gitleaks-secret-scanner

package.json

@@ -0,0 +1,12 @@
+{
+  "name": "entity-git-hooks",
+  "private": true,
+  "type": "module",
+  "description": "Root-level package for Git hooks tooling only - subfolders manage their own dependencies.",
+  "scripts": {
+    "prepare": "git --version && lefthook install || exit 0"
+  },
+  "devDependencies": {
+    "lefthook": "^1.11.3"
+  }
+}

pnpm-workspace.yaml

@@ -0,0 +1,3 @@
+packages: []
+allowBuilds:
+  lefthook: false