Lucas Berger
61b758648f
ci(16-05): add security job (gitleaks always; audit/outdated code-gated)
- New security job parallel to fast-checks, needs: [changes], if: pull_request
- actions/checkout@v4 with fetch-depth: 0 (Pitfall 3 — base.sha must be local)
- Probe PR base/head SHA step with git merge-base fallback (A2 / OQ-1)
- Install gitleaks v8.30.1 from GitHub releases (pinned, no actions/cache)
- Secret scan step (no if:) — blocking, uses .gitleaks.toml + baseline
- setup-node/pnpm/audit/outdated steps each gated by needs.changes.outputs.code