Standardize the pre-commit gates on the canonical hook
Add shared pre-commit hook: gitleaks secret scan + rustfmt gate