The secret sweep runs in CI, on every merge request and push to main

It ran by hand until now, and a by-hand gate is one that rots: the e2e
copy sat red for nine days after a formatter moved a marker, and nothing
said so. The job is the same script the release runbook already names,
called from the repository root, and it takes seconds.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.gitlab-ci.yml

@@ -3,6 +3,24 @@
 # they need an emulator and a local relay.
 stages: [test]
 
+# The repository is public, so this sweep is the last thing between a pasted
+# key and the internet. Until 2026-09-17 it only ran when somebody remembered
+# to, and it had been red for nine days without anyone noticing, because a
+# formatter carried an allow marker off the line it covered. A check nobody
+# runs protects nothing; here it runs on every merge request and every push
+# to main, and it finishes in seconds.
+secret-sweep:
+  stage: test
+  tags: [mac-local]
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_COMMIT_BRANCH == "main"'
+  variables:
+    GIT_DEPTH: "1"
+  script:
+    - bash scripts/secret-sweep.sh
+  timeout: 5m
+
 unit-tests:
   stage: test
   tags: [mac-local]