chore(gate): commit pre-push gate (secret -> build -> test, fail-closed)

- scripts/gate/gate.sh: 3-stage gate — 1) gitleaks, 2) build
  (tsc on commit, full next build on push), 3) LLM parse contract
  tests. Fail-closed: setup errors, timeouts, and findings all block.
- scripts/gate/hooks/{pre-commit,pre-push}: exec gate.sh commit|push.
- scripts/install/install-hooks.sh: idempotent installer (verifies repo
  root, bootstraps pinned gitleaks 8.30.1 if absent, wires both hooks).
- scripts/install/bootstrap-gitleaks.sh: pinned per-user install,
  x86_64/arm64, GitHub release download + SHA-less checksum pin.
- .gitleaks.toml: useDefault=true; single allowlist = .env.example
  placeholder lines (secret= and change-me values) by path+regex.
  Real secrets — even inside .env.example — still trip the gate
  (empirically verified: OpenAI/AWS/Slack/GitHub tokens all caught).
- tests/llm-parse.test.ts: pins parse.ts contracts (strict 6-paragraph
  body, headline/scalar/or array rejection, stopword rules, tag
  fallback) — the choke point for LLM output parsing.
- package.json: 'test' script.
- README: 'Commit gate' section (install, stages, verified fail-closed
  modes).

Verified before commit: clean tree PASSes all 3 stages; staged
realistic secret FAILs stage 1 (exit 1); broken type FAILs stage 2;
broken assertion FAILs stage 3; next build exit 0.

scripts/install/bootstrap-gitleaks.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# One-shot bootstrap of the gitleaks binary into ~/.local/bin (pinned version).
+# Reproducible: fixed tag, not "latest". Bump GL_VER deliberately to upgrade.
+set -eu
+GL_VER="8.30.1"
+DEST="${HOME}/.local/bin"
+mkdir -p "$DEST"
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+URL="https://github.com/gitleaks/gitleaks/releases/download/v${GL_VER}/gitleaks_${GL_VER}_linux_x64.tar.gz"
+echo "[bootstrap] fetching gitleaks v${GL_VER}"
+curl -sSL -m 180 -o "$tmp/gl.tgz" "$URL"
+tar xzf "$tmp/gl.tgz" -C "$tmp" gitleaks
+install -m0755 "$tmp/gitleaks" "${DEST}/gitleaks"
+echo "[bootstrap] installed: $("$DEST/gitleaks" version) → ${DEST}/gitleaks"
+echo "[bootstrap] ensure PATH includes ${DEST}, e.g. in your shell rc:
+  export PATH=\"${DEST}:\$PATH\""