• Add a dedicated secrets GitHub Actions job that runs detect-secrets with the repo baseline.
• Add .detect-secrets.cfg and .secrets.baseline to track known findings.
• Document how to respond to failures in docs/security.md, with a pointer in docs/troubleshooting.md.

Why:

• Prevent new secrets from being introduced while keeping known false positives under control.

Testing:

• detect-secrets scan --baseline .secrets.baseline

Notes:

• CI pins detect-secrets==1.5.0.
• Baseline currently contains existing findings; use detect-secrets audit .secrets.baseline for triage.