Catch a stale openapi.json at commit time, not 15 minutes into a Sando build
Block edits to already-committed migrations in the pre-commit hook
Add gitleaks secret-scan step to pre-commit hook
Add a rustfmt pre-commit gate