ci: sync gitleaks allowlist

.gitea/workflows/ci.yml

@@ -1,5 +1,4 @@
 ---
-# ci-sync: 2026-05-30T02:31:46Z
 # Homelab CI — Node/pages lane (git-ci-01) + secret scan (git-ci-02)
 name: CI
 

.gitleaks.toml

@@ -1,6 +1,15 @@
 # Homelab bootstrap — gitleaks allowlist (tests, examples, placeholders)
+#
+# IMPORTANT: `useDefault = true` is required — without it gitleaks loads ONLY
+# this file (title + allowlist) with ZERO detection rules, so it would never
+# flag a real secret. Fixed 2026-07 (security-hardening track); if you're
+# re-pushing this template to a repo that already had the old version, that
+# repo's secret scanning was a no-op until this lands.
 title = "homelab gitea bootstrap"
 
+[extend]
+useDefault = true
+
 [allowlist]
 description = "Test fixtures and example configs are not production secrets"
 paths = [