feat: shared gitleaks + privacy-scan (CI reusables + pre-commit hook)

[roleme]

What & why

Automate the secret/privacy scanning that was previously done by hand, and centralize it so every repo shares one rule set.

New

• gitleaks-reusable.yml — secret scan over full history (workflow_call), lifted from docker_infra's local gitleaks.yml.
• scripts/privacy-scan.sh — fails if tracked files contain private-infrastructure markers (private IP ranges, .local hosts, host paths like /home/* /volume* /etc/komodo/, key/secret markers). Built-in patterns are generic and safe for this public repo.
• privacy-scan-reusable.yml — runs the script. Callers pass their own private hostnames via the extra-patterns input → EXTRA_PATTERNS env, so secret-ish values live only in the private caller, never here. The script is checked out from this repo at job.workflow_sha (untamperable by the caller's tree).
• .pre-commit-hooks.yaml — exposes the same script as a pre-commit hook, so local hook and CI enforce identical rules.

Design note

privacy-scan.sh is the single source of truth, shared by CI and the local pre-commit hook. Private hostnames are never hardcoded in this public repo — they flow in via EXTRA_PATTERNS.

Validation

• shellcheck clean; zizmor no findings; privacy-scan clean on this repo; all YAML parses.

Follow-ups

• Wire these into docker_infra (replace local gitleaks.yml), bots, training_tracker.
• Add .pre-commit-config.yaml referencing this hook where wanted.

🤖 Generated with Claude Code