Standardize the pre-commit gates on the canonical hook
Wire the frontend lint into pre-commit; tighten a constants doc
Add gitleaks secret-scan step to pre-commit hook
Add a rustfmt pre-commit gate