chore: add pre-commit secret scanning

[dyoshikawa-claw]

Summary

• add repository-local mise tool versions for lefthook and gitleaks
• add a lefthook pre-commit hook that scans staged files with gitleaks
• document the minimal setup so contributors install the hook locally

Validation

• mise install
• lefthook install
• lefthook run pre-commit (safe staged file: passes)
• lefthook run pre-commit (staged test token: fails as expected)