fix(hooks): require the repo-pinned gitleaks, drop the fallbacks

A soft skip (and the system-gitleaks fallback) let a clone without
node_modules commit with no secrets scan at all, so the hook would
never force the install. The hook now hard-blocks with a hint to run
'npm i' until the @nogoo9/gitleaks binary is present in
node_modules/.bin.

Verified with the binary present (scan runs and passes) and absent
(blocked, exit 1).

.git-hooks/pre-commit

@@ -4,30 +4,27 @@
 # The first line is picked up by the VS Code GIT UI popup when rc is not 0
 
 # Scan staged changes for secrets before anything else runs.
-# The pinned binary comes from the @nogoo9/gitleaks devDependency
-# (installed into node_modules/.bin by npm i); a system gitleaks is used
-# as a fallback so commits are not blocked on a fresh clone.
-if [ -x node_modules/.bin/gitleaks ]; then
-    gitleaks_bin=node_modules/.bin/gitleaks
-else
-    gitleaks_bin=$(command -v gitleaks 2> /dev/null)
+# The binary is pinned by the @nogoo9/gitleaks devDependency and lands
+# in node_modules/.bin after npm i. Commits are blocked until it is
+# installed so no clone silently skips the secrets scan.
+gitleaks_bin=node_modules/.bin/gitleaks
+
+if [ ! -x "$gitleaks_bin" ]; then
+    echo "❌ gitleaks not found - run 'npm i' to install it"
+    exit 1
 fi
 
-if [ -n "$gitleaks_bin" ]; then
-    if ! "$gitleaks_bin" protect --staged --redact; then
-      echo "❌ gitleaks detected a potential secret in your staged changes"
-      echo "Remove the secret, or add a .gitleaksignore entry if it is a false positive"
-      exit 1
-    fi
-else
-    echo "⚠ gitleaks not found - run 'npm i' to install it (secrets scan skipped)"
+if ! "$gitleaks_bin" protect --staged --redact; then
+    echo "❌ gitleaks detected a potential secret in your staged changes"
+    echo "Remove the secret, or add a .gitleaksignore entry if it is a false positive"
+    exit 1
 fi
 
 ## Avoid large commits
 # https://www.backblaze.com/blog/how-many-bytes-are-in-a-megabyte-really/
 size_limit=$((2 * 1024 * 1024)) # 2MB
 # Sum the sizes of the blobs this commit would introduce: the staged
-# added/copied/modified/renamed/typchanged entries in the index.
+# added/copied/modified/renamed/typechanged entries in the index.
 # https://git-scm.com/docs/git-cat-file#Documentation/git-cat-file.txt---batch-check
 # Renames are treated as add+delete (--no-renames) and pure mode changes
 # (same blob, different permissions) add no new blob, so both are safe.