fix: initialize shared dependency caches before scoped startup

[roodboi]

A lockfile change could move a targeted restart to an empty dependency cache, while hack run deps continued installing into the ordinary Compose volume. Retrying the installer therefore did not repair the running app.

This change resolves the same fingerprinted cache for run, up, and restart. Before a scoped consumer starts or is recreated, Hack runs the declared cache installer with the same Compose files and environment. A failed installer leaves existing consumer containers in place. Unrelated services and project lifecycle hooks remain outside the scoped operation. Cache installers must be idempotent and coordinate concurrent writes; warm caches are checked without being deleted.

Automatic bootstrap is bounded to ten minutes, preserves JSON stdout, and returns E_DEPENDENCY_BOOTSTRAP_FAILED on failure. No cache hash, pruning policy, registry credential protection, or global configuration changes.

Validation:

• 42 focused tests (111 assertions) pass, including installer/consumer override parity, changed inputs, bootstrap failure, and unrelated-service isolation.
• CLI and full workspace type checking and lint pass.
• Compiled CLI Docker scenario verifies cold and warm caches, run deps mount parity, changed-lockfile restart/up, and failure isolation in a random disposable project.
• The compiled CLI also passed actual SIGINT/up and SIGTERM/restart probes: cancellation reached the installer, removed it in under two seconds, preserved the original consumer, and returned clean JSON errors. Failure probes preserved consumers and the E_DEPENDENCY_BOOTSTRAP_FAILED envelope.
• Local full CLI suite: 952 passed, 3 failed. The same three terminal/timeout fixtures fail on unmodified release 4.2.0 (57584748) with identical pinned dependencies. The published CI test and Linux process-lifetime gates pass on the current head.
• Independent local correctness review completed; its stdout and signal-forwarding findings are fixed. The final compiled Docker scenario passed in 244.1 seconds.

Release intent: patch fix. This PR does not publish or replace the globally installed CLI.

CI secret scanning now checks the full reachable history of the checked-out merge commit rather than unrelated fetched refs. Gitleaks remains mandatory, pinned to 8.30.1, and redacts reports. No allowlist or scanner bypass was added. The official binary passed a checksum check and scanned all 693 reachable commits locally; a synthetic committed-then-deleted credential negative control was detected with exit 1. The current head's published secret-scan check passes.