fix(policy-packs): install gitleaks before the repository check

[soulbah]

Change

The Policy Pack publication job runs bun run check before publishing, and that check includes the secret scan test, which runs Gitleaks. The job did not install Gitleaks, so the first publication for 0.2.0 stopped at Executable not found in $PATH: "gitleaks" before publishing anything. The job now installs the same verified Gitleaks 8.30.1 archive as the repository checks.

Validation

• actionlint on the workflow.
• bun scripts/validate-repository.ts passes.
• bun test scripts/secret-scan.test.ts passes with Gitleaks installed.

[rootform-contribution-delivery]

Contribution progress

Source: 03014bde8c12ad2216c06c633e6ec01388b8102f

Selected validations: docs, cli, dialects, policies, examples, distribution, tooling, generated. Repository safety always runs.

Stage	Status
Public validations	Passed (checks)
Documentation preview	Passed (open preview)
Development integration	Passed
Staging sites	Passed
Release	Not yet released

Applicable consumers are synchronized on their development branches and the staging sites. Releases are published from main; the Release row follows them.