Add secret scanning workflow with Gitleaks

[crypto-titan]

This workflow enforces secret scanning using Gitleaks on pull requests and pushes to the main branch, including a canary test for planted secrets.

Summary

Checklist

• pnpm test:all (or the CI-covered subset relevant to this change) passes locally.
• No seed phrases, master XPrvs, or other recovery secrets are sent to hosted services, logs, URLs, storage, or React/server payloads.
• The proof claim stays narrow: derivability of a payment credential from a master XPrv at a CIP-1852 path — nothing in this change overstates it.
• If this touches verifier keys, proving keys, pinned hashes, Cardano export fixtures, contract parameters, or ceremony manifests: the whole coherence set was refreshed and verified together (pnpm verify:proof-release).
• Security- or protocol-relevant changes include real derive/prove/verify/export or contract-path evidence with negative tests, not compile-only evidence.
• New behavior is covered by tests that would fail without the change.

[aikido-pr-checks]

GitHub Action actions/checkout persist Git credentials in workflow - low severity
actions/checkout v2 and above persist the default GITHUB_TOKEN in the repository's local git config when persist-credentials is not set to false, during the workflow run. Subsequent workflow steps or third-party actions can read this token from git configuration, increasing the risk of credential theft or misuse within the pipeline. In order to limit the attack surface when external actions are compromised, ensure persist-credentials is set to false.

Show fix

Remediation: Set persist-credentials: false on actions/checkout steps that do not need to push commits back to the repository. Only keep persist-credentials: true when the workflow explicitly performs authenticated git push operations.

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}