chore(gate): commit pre-push gate (secret -> build -> test, fail-closed)

- scripts/gate/gate.sh: 3-stage gate — 1) gitleaks, 2) build
  (tsc on commit, full next build on push), 3) LLM parse contract
  tests. Fail-closed: setup errors, timeouts, and findings all block.
- scripts/gate/hooks/{pre-commit,pre-push}: exec gate.sh commit|push.
- scripts/install/install-hooks.sh: idempotent installer (verifies repo
  root, bootstraps pinned gitleaks 8.30.1 if absent, wires both hooks).
- scripts/install/bootstrap-gitleaks.sh: pinned per-user install,
  x86_64/arm64, GitHub release download + SHA-less checksum pin.
- .gitleaks.toml: useDefault=true; single allowlist = .env.example
  placeholder lines (secret= and change-me values) by path+regex.
  Real secrets — even inside .env.example — still trip the gate
  (empirically verified: OpenAI/AWS/Slack/GitHub tokens all caught).
- tests/llm-parse.test.ts: pins parse.ts contracts (strict 6-paragraph
  body, headline/scalar/or array rejection, stopword rules, tag
  fallback) — the choke point for LLM output parsing.
- package.json: 'test' script.
- README: 'Commit gate' section (install, stages, verified fail-closed
  modes).

Verified before commit: clean tree PASSes all 3 stages; staged
realistic secret FAILs stage 1 (exit 1); broken type FAILs stage 2;
broken assertion FAILs stage 3; next build exit 0.

.gitleaks.toml

@@ -0,0 +1,29 @@
+# ────────────────────────────────────────────────────────────────────────────
+# gitleaks config — maple-brief commit gate (secret stage)
+#
+# Policy (fail-closed): the FULL default gitleaks ruleset (every known
+# provider / secret shape) hard-blocks at commit and pre-push. The ONLY
+# suppression is a tight, content-regexed allowlist scoped to a single file:
+# .env.example (the committed placeholder template). It suppresses ONLY those
+# exact placeholder lines. A real composite key pasted there (or anywhere)
+# STILL fires — verified on gitleaks 8.30.1 (linux x64).
+#
+# Gotchas found while validating (do not regress):
+#   • allowlist must be a MAP  [allowlist]  — a slice [[allowlist]] fails
+#     with "expected a map, got slice"
+#   • an embedded single quote inside a single-quoted (literal) TOML string
+#     silently closes it — keep regex strings double-quoted (basic)
+#   • paths= scopes the suppression to the file; regexes= to the lines
+# ────────────────────────────────────────────────────────────────────────────
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Suppress ONLY empty double-quoted placeholder values and the change-me example, in the .env template"
+paths = ['\.env\.example$']
+regexes = [
+  '^OPENAI_API_KEY=("")$',
+  '^ANTHROPIC_API_KEY=("")$',
+  '^NEXT_PUBLIC_ADSENSE_[A-Z_]+=("")$',
+  "^ADMIN_API_KEY=\"change-me[^\"]*\"$"
+]