ci: add content validation and secret scan

[shivros]

Summary

Adds the standard content-repository CI for agent-context:

• Validate: YAML (yamllint), JSON (jq), and TOML (tomllib) validation. JSON/TOML discovery safely succeeds when no matching files exist.
• Secret Scan: full-history Gitleaks scan with redacted output.

Validation

• yamllint passed for the manifest and workflow.
• actionlint v1.7.7 passed.
• gitleaks detect --source . --no-git --verbose --redact found no leaks.
• git diff --check passed.
• GitHub Actions passed both newly introduced checks on this PR: Validate and Secret Scan.

The historical acceptance step to update PR #2 is inapplicable: PR #2 merged before this CI branch. Future agent-context PRs now have the required check names for gate evaluation.

Closes COD-449.

[shivros]

🤖 Automated Review Panel

Reviewer A — GPT-5.6-terra

APPROVE — no material findings. The workflow meets the requested stable job names, trigger/permission constraints, safe no-match behavior, and full-history secret scan.

Reviewer B — Gemini 3 Flash

INCONCLUSIVE (environment limitation) — the reviewer was given the diff context but its isolated workspace did not contain the runner worktree, so it could not inspect files directly. It reported no workflow-semantic finding.

Local verification independently passed: yamllint, actionlint v1.7.7, Gitleaks (--no-git), and git diff --check.

[shivros]

Auto-Merge Gate approval

Confidence: 0.93

The CI workflow directly implements COD-449: deterministic YAML, JSON, and TOML validation plus a full-history, redacted Gitleaks scan. Scope is limited to the workflow and its YAML lint configuration. Both required checks succeeded (Validate, Secret Scan); the linked Linear issue has no manual-review marker; no unresolved review feedback is present.