docs(security): refine local secret management guidance

Supersedes: #406

Co-authored-by: Gabriel Nahum <gnahum12345@users.noreply.github.com>

.githooks/pre-commit

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if command -v gitleaks >/dev/null 2>&1; then
+  gitleaks protect --staged --redact
+else
+  echo "warning: gitleaks not found; skipping staged secret scan" >&2
+fi