Add secret scanning and prevent credential leaks

[arska]

Summary

• Add TruffleHog secret scanning to CI — scans PRs and pushes to master for verified secrets
• Add .gitignore entries for kubeconfig, PEM, key files, and .claude directory

Why

A service account token was accidentally committed in #1166 via a kubeconfig file in the working directory. This PR prevents that class of mistake:

1. Gitignore — prevents *.kubeconfig, *.pem, *.key, and .claude/ from being staged
2. TruffleHog — catches any secrets that slip through gitignore (verified secrets only, no false positives)

Test plan

• Verify TruffleHog runs on PRs
• Verify gitignore patterns match intended files

🤖 Generated with Claude Code

[arska]

Addressed both comments:

.gitignore: Removed the broad *.kubeconfig/*.pem/*.key entries and .claude/ catch-all. Now only ignores specific Claude Code local/session files as suggested.

TruffleHog: It's the most widely used open-source secret scanner in the GitHub Actions ecosystem — used by GitLab, Postman, and many CNCF projects. Key reasons:

• Verifies secrets against live services (only flags actually valid credentials, no false positives with --only-verified)
• Supports 800+ detector types out of the box (Kubernetes tokens, AWS keys, etc.)
• First-party GitHub Action maintained by the TruffleHog team
• Free and open source (AGPL)

Alternatives considered: gitleaks (popular but higher false positive rate without verification), GitHub's built-in secret scanning (only available for GitHub Advanced Security / Enterprise).

Happy to switch to another tool if the team prefers.

[tobru]

@Kidswiss Are you OK with introducing this secret scanner?

[Kidswiss]

Should we also add a pre-commit-hook? If we scan after the push, the damage is already done, and Gtihub will still show you deleted commits.