fix(ci): verify Gitleaks release archives

[Lutar, Stephen P. (stephenlutar2-hash)]

Summary

• Verify the official Gitleaks 8.21.2 Linux x64 archive before extraction.
• Use one pinned SHA-256 across GitHub Actions, CircleCI, and the portal workflow.
• Assert that each installed binary reports the expected version.
• Make the portal workflow's optional config arguments shell-safe.
• Align current secret-scanning docs with the active security.yml workflow.

Scope

• Keep Gitleaks at version 8.21.2.
• Keep the existing scanners, scan coverage, triggers, and permissions.
• Keep all action references and immutable action pins unchanged.
• Keep the root security fan-in job and its dependencies unchanged.
• Make no dependency or lockfile changes.

Verification

• git diff --check
• strict YAML parse for all three changed CI files
• Actionlint 1.7.12 and ShellCheck 0.11.0
• Bash syntax checks for six relevant shell bodies
• official SHA-256 manifest comparison
• Linux download, checksum, extraction, install, and exact-version probe
• Gitleaks: no unallowlisted findings in every changed tree
• project secret scanner: clean; 15/15 tests passed
• pnpm 10.26.1 typecheck: 182/182 tasks passed

Current-main lineage

This is the clean signed successor to #607 after #606 advanced main.
It is parented directly on e0cb7c61744fb64c15f59464e61c7fde15755e3a.
Its stable patch ID exactly matches #607: fa769b46dfcfcf6023513282607d1a1b910ecd69.
No checked history was rewritten.

Evidence boundary

The nested portal workflow is not a root platform hosted workflow at its current path.
It is hardened as a tracked extraction/template surface.

Merge gate

Require a valid GitHub signature and DCO, terminal exact-head hosted checks,
resolved threads, and a normal protected squash merge.

Workcell: SECRET-SCAN-INTEGRITY

Supersedes: #607
Follow-up to: #604

[Lutar, Stephen P. (stephenlutar2-hash)]

Superseded by clean mapped-identity successor #610. This PR was not merged: GitHub classified exact head 927e8ac as signature verified=false, reason=no_user, because its committer was the local placeholder codex-bot@szl-holdings.example. #610 is parented on the same current main, carries the identical stable patch ID, and uses the GitHub-mapped committer identity. No published history was rewritten.