Scans the full git history on push, pull request and weekly, so a credential
that was committed and later removed is still detected. The scanner archive is
pinned by version and verified by SHA-256 before it runs, and matched values
are redacted so they never reach the CI log.
