ci: gitleaks was passing without scanning anything

The secret-scanning gate has been green and meaningless. `docker run -v "$PWD:/repo"`
resolves the bind source on the dind sidecar's daemon, not in the job container, so
gitleaks received an empty mount:

    ERR [git] fatal: not a git repository (or any parent up to mount point /)
    ERR failed to scan Git repository error="stderr is not empty"
    INF scan completed in 35.2ms
    INF no leaks found          <- exit 0

It logged the failure and exited 0. A scanner that reports success without looking is
worse than no scanner. The 35ms runtime was the tell.

Now a checksum-pinned binary, plus a `git rev-list --count HEAD` assertion so an
unscannable checkout fails the job instead of passing it.

Same root cause and same fix for yq in bump-digests.sh, which failed the bump job with
"stat deploy/chart/values.yaml: no such file or directory". helm was fixed this way
earlier. Nothing on this runner should mount $PWD into a container.

scripts/bump-digests.sh

@@ -22,21 +22,50 @@ set -euo pipefail
 SERVICES=(api worker reconciler)
 CHART_VALUES="deploy/chart/values.yaml"
 
-# yq, pinned by digest. Not python+pyyaml: a yaml round-trip strips every comment in
-# values.yaml, and those comments are the only thing explaining why the digests are there.
-# yq edits in place and leaves the rest of the file alone.
-YQ_IMAGE="mikefarah/yq:4.44.6@sha256:b1d117c609ba990436ad1649299e2f6c378f62cb562caf30b6f2fb6144713422"
-
 WORKDIR="$(mktemp -d)"
 cleanup() {
     rm -rf "${WORKDIR}"
 }
 trap cleanup EXIT
 
-yq() {
-    docker run --rm -v "${PWD}:/work" -w /work -u "$(id -u):$(id -g)" "${YQ_IMAGE}" "$@"
+# yq as a checksum-pinned binary, NOT `docker run -v "$PWD:/work"`.
+#
+# The container form cannot see the checkout on the Gitea runner: the -v source path is
+# resolved by the dind sidecar's daemon, not by the job container, so yq reported
+# "stat deploy/chart/values.yaml: no such file or directory" for a file that plainly
+# exists. The same boundary silently broke helm and gitleaks.
+#
+# Not python+pyyaml: a yaml round-trip strips every comment in values.yaml, and those
+# comments are the only thing explaining why the digests are there. yq edits in place.
+YQ_VERSION="4.44.6"
+YQ_SHA256="9477ac3cc447b6c083986129e35af8122eb2b938fe55c9c3e40436fb966e5813"
+
+ensure_yq() {
+    if command -v yq >/dev/null 2>&1; then
+        return
+    fi
+    local arch
+    case "$(uname -m)" in
+        aarch64|arm64) arch=arm64 ;;
+        x86_64)        arch=amd64 ;;
+        *) echo "!! unsupported arch $(uname -m)" >&2; exit 1 ;;
+    esac
+    curl -fsSL -o "${WORKDIR}/yq" \
+        "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_${arch}"
+    # Only the arm64 digest is pinned; this runner is Ampere. On another arch the download
+    # is still version-pinned, and the mismatch is reported rather than silently accepted.
+    if [ "${arch}" = "arm64" ]; then
+        echo "${YQ_SHA256}  ${WORKDIR}/yq" | sha256sum -c -
+    else
+        echo "warning: no pinned checksum for ${arch}; version-pinned only" >&2
+    fi
+    chmod +x "${WORKDIR}/yq"
+    PATH="${WORKDIR}:${PATH}"
+    export PATH
 }
 
+ensure_yq
+
 echo "==> resolving digests for tag ${IMAGE_TAG}"
 for svc in "${SERVICES[@]}"; do
     image="${REGISTRY}/${IMAGE_NS}/svcforge-${svc}"