Build and push to harbor.mymx.me/library/derp after gitleaks
and test jobs pass. Only runs on push to master. Tags with
short SHA and latest.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add gitleaks secret scanning (full history)
- Separate lint (ruff, Python 3.13 only) from test matrix
- Test job gates on lint; gitleaks runs in parallel
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>