feat: add /secrets-scan skill and pre-ship gate (Step 3.48)

[Paebak]

Motivation

Working in threat detection and log management at a Fortune 100 company — processing petabytes of data daily across a large enterprise environment — one pattern shows up constantly: teams shipping code with hardcoded credentials. It's one of the most common and most preventable incident triggers. You see it in git history audits, in SIEM alerts firing on leaked tokens, in post-incident reviews. The fix is almost always the same: the developer didn't have a fast, in-context check that caught it before the push.

gstack ships fast. That's the whole point. This PR adds a lightweight secrets gate so speed doesn't come at the cost of a credential leak.

What's in this PR

New skill: /secrets-scan

A standalone skill (secrets-scan/SKILL.md) that scans the branch diff and git history for hardcoded secrets before code lands. Six phases:

1. Scope detection — determines base branch and files changed
2. Diff scan — regex + entropy patterns across the branch diff for AWS keys, GitHub tokens, Slack tokens, OpenAI keys, Google API keys, JWTs, private keys, and generic key/secret/password patterns
3. History scan — checks commits on the branch (not in base) for accidental credential commits
4. Confidence scoring — each finding is scored; only findings >= 60 confidence surface (reduces noise)
5. Remediation guidance — exact fix per finding type (rotate, rm --cached, filter-repo, replace with env var)
6. Gate logic — when called from /ship, blocks with AskUserQuestion or passes silently

Auto-filters false positives: process.env. references, ${VAR} interpolations, placeholder strings (your-key-here, CHANGEME, xxxx), test fixture paths, and comments.

/ship Step 3.48

Inserts the secrets scan gate between Step 3.47 (plan verification) and Step 3.5 (pre-landing review). Loads /secrets-scan inline — same pattern as the existing plan verification step. Adds a ## Secrets Scan section to the PR body.

If the skill file is missing, the gate skips gracefully and logs the reason.

Test plan

• /secrets-scan runs standalone on a branch with no secrets — prints CLEAR
• /secrets-scan detects a hardcoded AKIA... AWS key in a diff — surfaces with CRITICAL finding
• /secrets-scan ignores process.env.API_KEY and ${TOKEN} references — no false positive
• /ship runs Step 3.48 and passes through cleanly on a clean branch
• /ship Step 3.48 blocks and shows AskUserQuestion when a finding >= 60 confidence is found
• Gate skip message appears when secrets-scan/SKILL.md is not installed

🤖 Generated with Claude Code