ci: single Gitea Actions pipeline, uv-based image, scoped docker cleanup

Replace lint/test/docker workflows with ci.yml (gitleaks, lint, test-unit, test-integration, test-mcp, build-and-push, docs-check, security). Rebuild the Dockerfile as a digest-pinned multi-stage uv build running as uid 1000, add .dockerignore, a hardened compose file and a gitleaks config. The integration harness now falls back to /etc/hostname and /proc/self to find its own container.

scripts/ci/install_gitleaks.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Install a pinned gitleaks release into a directory, verifying its sha256.
+#
+# Usage: scripts/ci/install_gitleaks.sh <dest-dir>
+#
+# The binary ends up at <dest-dir>/gitleaks. To upgrade, bump GITLEAKS_VERSION
+# and both digests from the release's gitleaks_<version>_checksums.txt.
+set -euo pipefail
+
+GITLEAKS_VERSION="8.30.1"
+SHA256_X64="551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+SHA256_ARM64="e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080"
+
+dest="${1:?usage: install_gitleaks.sh <dest-dir>}"
+
+case "$(uname -m)" in
+  x86_64 | amd64)
+    arch="x64"
+    expected="${SHA256_X64}"
+    ;;
+  aarch64 | arm64)
+    arch="arm64"
+    expected="${SHA256_ARM64}"
+    ;;
+  *)
+    echo "unsupported architecture: $(uname -m)" >&2
+    exit 1
+    ;;
+esac
+
+archive="gitleaks_${GITLEAKS_VERSION}_linux_${arch}.tar.gz"
+url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}"
+
+work="$(mktemp -d)"
+trap 'rm -rf "${work}"' EXIT
+
+curl --fail --silent --show-error --location --retry 3 --output "${work}/${archive}" "${url}"
+echo "${expected}  ${work}/${archive}" | sha256sum --check --status || {
+  echo "sha256 mismatch for ${archive}" >&2
+  exit 1
+}
+
+mkdir -p "${dest}"
+tar -xzf "${work}/${archive}" -C "${dest}" gitleaks
+chmod 0755 "${dest}/gitleaks"
+"${dest}/gitleaks" version