A soft skip (and the system-gitleaks fallback) let a clone without node_modules commit with no secrets scan at all, so the hook would never force the install. The hook now hard-blocks with a hint to run 'npm i' until the @nogoo9/gitleaks binary is present in node_modules/.bin. Verified with the binary present (scan runs and passes) and absent (blocked, exit 1).