How to Set Up gitleaks + pre-commit + CI [2026]

A terminal-first, defense-in-depth secrets workflow for 2026: staged-only hooks, CI full-history scans, baselines for legacy repos, and sane allowlists.