This PR hardens and modernizes our existing global Git hook model for secret scanning.

[wz-gsa]

Changes proposed in this pull request:

Summary

This PR hardens and modernizes our existing global Git hook model for secret scanning.

We were already using core.hooksPath, but this change:

• moves hooks to a standard XDG location (~/.config/git/hooks)
• makes install/verify deterministic and testable
• reduces drift and silent misconfiguration
• preserves compatibility with repo-local tooling (prek / pre-commit)

What changed (vs previous behavior)

• New hook location (XDG):
  Hooks now live in ~/.config/git/hooks instead of the previous custom path.
  make install migrates and updates core.hooksPath automatically.

• Single, explicit hook wrapper:
  One wrapper governs both pre-commit and pre-push behavior:

  • pre-commit: staged-only scan (fast)
  • pre-push: scan only commits being pushed (not full history)

• Config safety:
  Installer writes/repairs the global gitleaks config and enforces extend defaults.

• Functional verification:
  make verify / make audit prove secrets are blocked and clean commits pass.

• prek / pre-commit compatible:
  Repo-local hooks still run after gitleaks, so teams can layer linters/formatters.

• Safer lifecycle:
  Install saves any previous core.hooksPath; uninstall restores it.

How to switch

git pull
make install
make verify

That will:

• move hooks to ~/.config/git/hooks
• update core.hooksPath
• ensure gitleaks is installed and configured correctly

If something looks off:

git config --global --get core.hooksPath
ls -la ~/.config/git/hooks
make verify

Security considerations

• Strengthens secret-scanning enforcement by making the global-hook model deterministic and verifiable.
• Global gitleaks config is enforced to extend defaults (no silent detector loss).
• Per-repo allowlists (.gitleaks.repo.toml) are supported but should be reviewed carefully.
• SKIP=gitleaks remains as a deliberate break-glass option.
• Repos that override core.hooksPath locally can bypass global hooks; check_repos.sh detects this.

[pburkholder]

On gitleaks failure, no longer echoes the hints on how to handle false positives.

[wz-gsa]

Gitleaks fail should now include the skip hint for false positives.