ci: enforce detect-secrets baseline

[lucarlig]

Summary

• add a dedicated detect-secrets job to the existing CI workflow
• keep workflow YAML minimal by delegating to scripts/ci/detect-secrets.sh
• install only the pinned IBM detect-secrets fork in a runner-local virtualenv
• run detect-secrets-hook against all tracked files with the audited-baseline gate enabled
• allow the job to bootstrap cleanly before .secrets.baseline is added to main

Why

The existing Rust CI jobs can all pass without exercising detect-secrets. PR #80 demonstrated this: the committed baseline was stale, but the standard CI rollup remained green.

After this PR lands, PR #80 can be rebased onto main; the new job will then detect its baseline drift and enforce detect-secrets on every pull request and push to main.

Impact

The job reports a notice and passes until .secrets.baseline exists. Once the baseline is present, new findings, unaudited entries, and baseline rewrites fail CI.

Validation

• actionlint .github/workflows/ci.yml
• bash -n scripts/ci/detect-secrets.sh
• shellcheck scripts/ci/detect-secrets.sh
• git diff --check
• verified current main selects bootstrap mode
• verified PR chore: adopt make pre-commit workflow with full pre-commit hook suite #80 activates the direct hook and exposes its stale baseline
• verified the same hook passes after the corrected baseline is staged
• repository commit gate passed: fmt, clippy, cargo-deny, nextest, build, and bench

[gandhipratik203]

LGTM! Sync with the PR #80 for the merge order.