Add CodeQL and secret scanning CI gates

[negillett]

Summary

• Adds Python CodeQL analysis with intentproof-extra pack, gitleaks, and pre-commit.

Test plan

• Workflow validation pending on PR

Review

No blocking internal review findings.

Manual steps (org settings)

Enable GitHub Advanced Security and secret-scanning push protection for this
repository in IntentProof organization settings. These cannot be set via code.

[cursor]

PR Summary

Low Risk
Low runtime risk since changes are CI/config only, but it may newly fail PRs due to CodeQL findings, expired allowlist entries, or detected secrets.

Overview
Introduces a new codeql GitHub Actions workflow that runs on pushes/PRs and on a schedule, performing Python CodeQL analysis and uploading security results.

Adds a CodeQL finding allowlist file (.github/codeql-allowlist.yml) plus a CI gate (scripts/check-codeql-allowlist.sh) that fails when allowlist entries are missing/invalid/expired.

Adds gitleaks secret scanning in CI and a matching local pre-commit hook, with repository-specific allowlists in .gitleaks.toml to reduce false positives.

^{Reviewed by Cursor Bugbot for commit f4b2fbe. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f82149b. Configure here.}