Setup a gitleaks credential gate

<SKILL_DIR> = this skill directory. <PROJECT_DIR> = the repo being gated.

The gate is two layers, and the split is the design:

1. gitleaks layer — credentials only: passwords, tokens, API keys, private keys, connection strings. Custom [[rules]] because gitleaks' default rule set cannot know repo-specific secrets.
2. pattern layer — identifiers gitleaks cannot judge: internal domains, node names, project names, person names. A grep -E pass in the same gate script.

gitleaks passing ≠ sanitize complete. Rule files and checker output must carry this boundary explicitly, or reviewers assume a green gate means clean.

Step 1 — Harvest rule candidates

Secrets live where the repo's real workflow puts them. Collect patterns from: