Block secret externalization from Forge workflows

[eshulman2]

Summary

• add fail-closed secret detection before every Git push
• scan committed, staged, unstaged, and relevant untracked changes against the trusted origin
• scan GitHub PR/comment and Jira comment content before HTTP publication
• support trusted-base .secrets.baseline allowlists
• redact findings so matched values never enter logs or blocked-state messages
• block on timeouts, scanner errors, unsafe symlinks, and invalid baselines

Test plan

• 75 focused tests pass
• relevant GitHub/Jira compatibility tests pass
• Ruff passes
• coverage includes provider keys, generic tokens, clean text, baselines, binary and untracked files, symlinks, timeouts, and redaction

Integration note

#263 introduces the preferred common OutputValidator boundary. If it merges first, this PR should be rebased and its Git-push scanner adapted to that interface so Forge has one composed pre-push security gate rather than duplicate hooks. GitHub/Jira text-publication scanning remains specific to this PR.

Closes #77

Related: #263

[eshulman2]

Closing to rework the implementation around Forge's provenance boundaries: secret scanning will compose into #263's pre-push validator and workflow nodes will explicitly scan agent-derived text instead of globally intercepting Jira/GitHub clients.