fix: security issues and use gitleaks (#163)

* fix(tests): remove unused test constants and helpers

Delete dead test code that caused 41 staticcheck U1000 violations:
- cli/test_constants.go (25 unused constants)
- cli/terminal_test_helpers.go (unused type, method, 7 variables)
- fileproc/test_constants.go (5 unused constants)
- fileproc/processor_test.go (2 unused helper functions)

* fix(security): replace custom secret detection with gitleaks

The hand-rolled check_secrets regex patterns produced false positives
on configKey test values, causing make security-full to fail.

Replace with gitleaks via go run for proper secret detection with
built-in rules and allowlist support for generated report files.

* chore(deps): update dependencies and fix install-tools

Update Go module dependencies to latest versions.
Fix checkmake install path and remove yamllint go install
(yamllint is a Python tool, not installable via go install).

* docs: add design document for gitleaks integration

* feat: update go to 1.25.6

fileproc/processor_test.go

@@ -31,54 +31,6 @@ func writeTempConfig(t *testing.T, content string) string {
 	return dir
 }
 
-// collectWriteRequests runs a processing function and collects all WriteRequests.
-// This helper wraps the common pattern of channel + goroutine + WaitGroup.
-func collectWriteRequests(t *testing.T, process func(ch chan fileproc.WriteRequest)) []fileproc.WriteRequest {
-	t.Helper()
-
-	ch := make(chan fileproc.WriteRequest, 10)
-
-	var wg sync.WaitGroup
-	wg.Go(func() {
-		defer close(ch)
-		process(ch)
-	})
-
-	results := make([]fileproc.WriteRequest, 0)
-	for req := range ch {
-		results = append(results, req)
-	}
-	wg.Wait()
-
-	return results
-}
-
-// collectWriteRequestsWithContext runs a processing function with context and collects all WriteRequests.
-func collectWriteRequestsWithContext(
-	ctx context.Context,
-	t *testing.T,
-	process func(ctx context.Context, ch chan fileproc.WriteRequest) error,
-) ([]fileproc.WriteRequest, error) {
-	t.Helper()
-
-	ch := make(chan fileproc.WriteRequest, 10)
-	var processErr error
-
-	var wg sync.WaitGroup
-	wg.Go(func() {
-		defer close(ch)
-		processErr = process(ctx, ch)
-	})
-
-	results := make([]fileproc.WriteRequest, 0)
-	for req := range ch {
-		results = append(results, req)
-	}
-	wg.Wait()
-
-	return results, processErr
-}
-
 func TestProcessFile(t *testing.T) {
 	// Reset and load default config to ensure proper file size limits
 	testutil.ResetViperConfig(t, "")