feat(scan): dogfood the shipped gitleaks + semgrep gate on the maintainer repo

[maybebyte]

Summary

Dogfood the template's enable_scanners layer (gitleaks + semgrep) onto the maintainer repo, closing gap #2 of the dogfooding-gap audit — the one substantive security gap. gitleaks now scans the maintainer's full commit history; semgrep mirrors the shipped SAST gate.

Changes

• Add .gitleaks.toml + .semgrep.yml (verbatim from the template), gitleaks = "8.30.1" in mise.toml, an out-of-band just scan recipe, and a blocking scan job in test-template.yml (sibling to zizmor; mise-action SHA-pinned # v4.2.0, no GH_TOKEN, fetch-depth: 0).
• Document the gate + the manual pin-sync obligation in AGENTS.md; design + plan under docs/superpowers/.

Testing

• just scan locally: gitleaks 161 commits scanned, no leaks; semgrep exits clean.
• TMPDIR=… just test — full generation matrix, 70 passed (3m 23s).
• zizmor --persona=regular . clean on the new job; workflow YAML parses; the zizmor-version drift test passes.

Notes for reviewers

• semgrep is currently inert here: its built-in .semgrepignore excludes tests/, and there is no src/, so it scans 0 files today. Kept as a byte-parity mirror + forward guard (fires the moment any non-test Python lands at root) — the identical command the template runs against downstream src/. Dropping it as not-applicable (like the audit did for mutmut/coverage) is a trivial reversal; flagged in the design's Out-of-scope.
• The maintainer has no Renovate and the generation drift test reads only the rendered downstream, so the gitleaks/semgrep pins here are guarded only by the AGENTS.md manual-sync note (documented).
• No template/ files touched → no CHANGELOG entry, no version tag.

Related

• Closes gap docs(plan): add dependency-surface inventory implementation plan #2 of docs/superpowers/plans/2026-07-01-dogfood-gap-audit.md