Add lightweight security scanning (gitleaks + dependency audit) to CI

[williamzujkowski]

Problem

repo_analyze and repo_security_plan report no SAST/SCA/secrets scanning. CI (.github/workflows/ci.yml) runs only typecheck, test, and build.

Suggested fix

Add a low-cost scanning job. For this TypeScript/pnpm project:

• Secrets: gitleaks/gitleaks-action@v2 (critical-tier, cheap, no config).
• SCA: a dependency audit step against pnpm-lock.yaml, e.g. pnpm audit --audit-level=high or osv-scanner (note: there is no package-lock.json, so npm audit is not directly applicable).
• SAST (optional): CodeQL or Semgrep config: auto.

Keep it to the critical-tier scanners to avoid the redundancy the security plan flags. Low priority for an internal exerciser, but closes a standard org hygiene gap.