ci: gitleaks was passing without scanning anything

The secret-scanning gate has been green and meaningless. `docker run -v "$PWD:/repo"`
resolves the bind source on the dind sidecar's daemon, not in the job container, so
gitleaks received an empty mount:

    ERR [git] fatal: not a git repository (or any parent up to mount point /)
    ERR failed to scan Git repository error="stderr is not empty"
    INF scan completed in 35.2ms
    INF no leaks found          <- exit 0

It logged the failure and exited 0. A scanner that reports success without looking is
worse than no scanner. The 35ms runtime was the tell.

Now a checksum-pinned binary, plus a `git rev-list --count HEAD` assertion so an
unscannable checkout fails the job instead of passing it.

Same root cause and same fix for yq in bump-digests.sh, which failed the bump job with
"stat deploy/chart/values.yaml: no such file or directory". helm was fixed this way
earlier. Nothing on this runner should mount $PWD into a container.

.gitea/workflows/ci.yaml

@@ -28,6 +28,8 @@ env:
   REGISTRY: gitea.oci-oci.duckdns.org
   IMAGE_NS: gitea_admin
   UV_VERSION: "0.5.11"
+  GITLEAKS_VERSION: "8.21.2"
+  GITLEAKS_SHA256: "654c935542c89f565aabe7bf7c6c500830f116c114f0aeb509d2460c1ac2e6da"
 
 jobs:
   # --- stage 1: lint -- fast, fails first ---------------------------------------------
@@ -155,12 +157,37 @@ jobs:
         run: uv run --with 'bandit[toml]' bandit -c pyproject.toml -r libs services -ll
 
       - name: gitleaks (secret scan)
-        # Pinned by digest and run directly, so the command is the documented one rather
-        # than a marketplace action's opinion of it.
+        # A downloaded binary, not `docker run -v "$PWD:/repo"`.
+        #
+        # The container form was scanning NOTHING and passing. `-v "$PWD:/repo"` is
+        # interpreted by the dind sidecar's daemon, which cannot see the job container's
+        # checkout, so gitleaks got an empty mount and logged:
+        #
+        #     ERR [git] fatal: not a git repository (or any parent up to mount point /)
+        #     ERR failed to scan Git repository error="stderr is not empty"
+        #     INF scan completed in 35.2ms
+        #     INF no leaks found          <- exit 0
+        #
+        # It reported success without looking, which is worse than having no scanner: the
+        # gate was green and meaningless. The 35ms runtime was the tell — a real history
+        # scan of this repo takes seconds.
+        #
+        # The `--log-opts` + commit-count assertion below is the guard against that class
+        # of failure returning. A scanner that cannot fail is not a gate.
         run: |
-          docker run --rm -v "$PWD:/repo" -w /repo \
-            ghcr.io/gitleaks/gitleaks:v8.21.2@sha256:0e99e8821643ea5b235718642b93bb32486af9c8162c8b8731f7cbdc951a7f46 \
-            detect --no-banner --source /repo
+          set -euo pipefail
+          curl -fsSL -o /tmp/gitleaks.tgz \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_arm64.tar.gz"
+          echo "${GITLEAKS_SHA256}  /tmp/gitleaks.tgz" | sha256sum -c -
+          tar -xzf /tmp/gitleaks.tgz -C /tmp gitleaks
+          install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks
+
+          # Prove there is a repository to scan before trusting the verdict.
+          commits=$(git rev-list --count HEAD)
+          echo "scanning $commits commits"
+          test "$commits" -gt 0
+
+          gitleaks detect --no-banner --source . --redact --exit-code 1
 
       - name: pip-audit (dependency CVEs)
         # --strict fails on an audit error rather than shrugging and reporting clean.