Catch it before the commit, know what to do if it leaks anyway

Covers pre-commit and CI secret scanning tools, plus the concrete step-by-step response when a secret leaks regardless.