fix: scan for secrets with the version the project pins

[ttncode]

What this changes

The gitleaks job runs mise run secrets — the task and the pinned binary the generated project already has — instead of gitleaks/gitleaks-action.

Why

The action builds its scan range as <first commit of the push>^..<last>. On a repository's first push that first commit is the root commit, which has no parent:

gitleaks cmd: … --log-opts=--no-merges --first-parent ca9c409…^..f26976e…
ERR [git] fatal: ambiguous argument 'ca9c409…^..f26976e…': unknown revision
ERR failed to scan Git repository error="stderr is not empty"
WRN scanned ~0 bytes (0)
WRN no leaks found in partial scan
##[error]ERROR: Unexpected exit code [1]

Reproduced deterministically in an isolated repository: first push red having scanned nothing, second push green. The red is not the problem — the problem is a scan that did not happen reporting "no leaks found". If a secret were in those first commits, that is the run that should have caught it.

v3.0.0 is the latest release and is what we pin, so there is nothing to bump to.

Second, quieter: the action downloads gitleaks 8.24.3 while generated projects pin 8.30.0 for their commit hook. The hook and CI were scanning with different versions.

Why this shape

immich runs no secret scanner in CI at all — it relies on GitHub's own secret scanning and push protection — and runs every other tool through mise run <task> rather than a per-tool wrapper action. Both halves apply here:

• scaffold publish now turns GitHub's scanning and push protection on where the plan allows (blocking a secret at push time beats scanning after it lands).
• Private repositories on a plan without Advanced Security get nothing from that, and generated client projects are private — so CI keeps a scan, run the way every other tool here is run.

One pinned version, the whole history, no range arithmetic to get wrong.

Verified

With the pinned 8.30.0 against a repository whose root commit carries a planted token:

INF 1 commits scanned.
INF scanned ~51 bytes (51 bytes)
WRN leaks found: 1        exit 1

One commit scanned where the action scanned zero, and a real finding fails the job.