chore: consolidate security scanning tools

[vredchenko]

Summary

• Remove detect-secrets and trufflehog from pre-commit hooks, lefthook, and CI workflow (secret scanning consolidated to gitleaks)
• Remove pip-audit scan script (scripts/pip-audit-scan-repos.sh) (vulnerability scanning consolidated to osv-scanner)
• Delete .secrets.baseline (only used by detect-secrets)
• Update documentation references (ADR, ARCHITECTURE.md, skill/agent docs) to reflect gitleaks as the single secret scanner

This reduces the security tool stack from 6 tools to 3 (gitleaks + osv-scanner + pre-commit-hooks), simplifying maintenance and aligning with the organisational preference for gitleaks.

Changes

File	Change
.pre-commit-config.yaml	Remove detect-secrets and trufflehog hook entries
.secrets.baseline	Deleted
lefthook.yml	Remove trufflehog from pre-push hooks
.github/workflows/leaked-secrets-scan.yml	Remove detect-secrets and trufflehog jobs, keep gitleaks
scripts/pip-audit-scan-repos.sh	Deleted (osv-scanner covers this)
ADR 0005	Status updated to "Superseded by gitleaks consolidation"
claude-code/ARCHITECTURE.md	detect-secrets reference updated to gitleaks
claude-code/shared/skills/devops/SKILL.md	detect-secrets reference updated to gitleaks
claude-code/smartem-decisions/agents/devops.md	detect-secrets reference updated to gitleaks