Add detect-secrets scanning

[brian-hussey]

Add detect-secrets scanning

Closes internal: contextforge-org/internal_issues#624

What this does

Wires IBM's hardened detect-secrets fork into the project as a first-class quality gate, matching the pattern already established in mcp-context-forge.

Changes

.secrets.baseline — initial baseline generated and audited; all findings confirmed as false positives (test fixtures, example values, generated API types).

package.json — two new developer scripts:

• npm run secrets:scan — re-scans the repo and updates .secrets.baseline
• npm run secrets:audit — interactive audit of findings (mark false positives)

.husky/pre-commit — detect-secrets-hook added alongside lint-staged; blocks commits that introduce new unaudited secrets.

README.md — new Secrets Scanning subsection under Code Quality with usage instructions and troubleshooting guidance for the two most common failure modes; secrets:scan and secrets:audit added to the Available Scripts table.

[gcgoncalves]

THANKS!

[brian-hussey]

I'm trying to sort out the github actions to defend us, but I can't figure out where changes are slipping in.
If this doesn't pan out, I'll remove the github action and we can have a static file that we update periodically and that should get us over the check we need it for.

[brian-hussey]

@gcgoncalves I'm going to remove the github action piece for this at the moment and I think that will satisfy the check to get our internal scans working for the moment.