secrets-precommit — block committed secrets before they hit history

A pre-commit bundle that catches secrets at the commit — with a curated ruleset, an allowlist to kill false positives, and a baseline so existing repos adopt cleanly.