chore(devsecops): enable secret-scan PR gate

[intelligentinfrateam]

Enable secret-scan PR gate

This PR adds two files:

• .github/workflows/secret-scan-pr.yml — runs gitleaks on the diff of
  each pull request and fails the build if a secret is committed.
  Scans only the new commits in the PR, not the full repo history, so
  it does not block PRs over pre-existing material.
• .gitleaks.toml — Plaud-AI baseline config: inherits the upstream
  ruleset (AWS, Stripe, GitHub, Slack, OpenAI, Sentry, ...) and
  allowlists lockfiles, test fixtures, docs, build artifacts, and
  obvious placeholder values.

What changes for contributors

• New secrets in a PR diff → CI red, PR blocked.
• A false positive → add the path or pattern to .gitleaks.toml in the
  same PR with a one-line comment explaining why it is safe.
• Existing secrets in main are untouched here; they are tracked by the
  org-wide history scan and rotated separately.

How to verify before merging

Push a throwaway commit to this branch with a fake AWS key:

• AKIAIOSFODNN7EXAMPLE is allowlisted (vendor example) → CI green.
• AKIA1A2B3C4D5E6F7G8H (any other AKIA-shape) → CI red.
  Revert before merge.

Why

Org-wide DevSecOps Phase 2. The Phase 1 history scan found hardcoded
secrets across multiple repos; this gate stops new ones being added
while the backlog is rotated.

Questions: ping the DevSecOps owner in #security-incidents.

🤖 Automated rollout — safe to close + reopen later if you want CI to re-run.