ci: scan for secrets and audit workflows

[altaywtf]

Change

Pull requests and a weekly run go through put.io's shared security scan: Gitleaks, TruffleHog, Actionlint and Zizmor. The new .github/workflows/scan.yml:

on:
  pull_request:
  schedule:
    - cron: "41 6 * * 1"
  workflow_dispatch:
# …
jobs:
  scan:
    permissions:
      contents: read
    uses: putdotio/.github/.github/workflows/frontend-scan.yml@1ee0d3b473cbc6fada08831f01ff80fe653c434a # v1.1.0

• Gradle Dependabot updates get the npm entry's one-day cooldown; .github/zizmor.yml matches the other put.io repositories.
• The setup-java and setup-gradle pin comments name their exact tags; the SHAs are unchanged.

Validation

• Zizmor and Actionlint clean; Gitleaks over full history finds nothing, and TruffleHog finds no verified secrets
• The markdownCheck oxfmt command passes
• Skipped: ./gradlew verify; no Kotlin, Gradle or app input changed

---

Written by an agent (Claude Code, Opus 5.5)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.