chore(pre-commit): scope the private-key hook exclusion and drop the dead gitleaks ignore (#2218)

The detect-private-key hook skipped every *_test.go file and a frontend
path that does not exist in this repo, so a real key committed in any
test file went unchecked. Exclude only the two files that embed
PEM-shaped dummy keys (cmd/configure_test.go, cmd/configure_gcp_test.go),
found by running the hook with no exclude.

.gitleaksignore is removed: nothing here runs gitleaks and its only
entry points at a file that does not exist in this repo.

Closes #448

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: cristim

.gitleaksignore

@@ -48,11 +48,8 @@ repos:
         name: Check for merge conflicts
       - id: detect-private-key
         name: Detect private keys
-        # Audit (PR5): internal/credentials/resolver.go contains zero
-        # private-key-shaped patterns (verified by grep). The exclusion
-        # was a historical artifact; removing it tightens the gate
-        # without breaking any legitimate code.
-        exclude: '(_test\.go|frontend/src/index\.html)$'
+        # Only these test fixtures embed PEM-shaped dummy keys; any other file is scanned.
+        exclude: '^(cmd/configure_test\.go|cmd/configure_gcp_test\.go)$'
       - id: check-case-conflict
         name: Check for case conflicts