Secrets hygiene

A credential that reaches a repository is already compromised: history is permanent and clones are everywhere, so rotation is the only real cure. This project learned it directly — on 2026-07-04 a blanket git add -A swept an .env backup into a commit, which is why staging explicit paths is now a standing rule, alongside the bandit gate in make quality.

This module builds the defence that catches it earlier: a scanner over the diff, before it lands.