docs(code-quality): baselines assume gitleaks git mode — record the dependency (backend#1404 §4)

[LukasWodka]

Comment-only. Step 4 of backend#1404: all three gitleaks invocations are commit-scoped (gitleaks git), and the fleet's baseline fingerprints embed the introducing commit SHA — so they only match git-mode scans. A future switch of any branch to dir/detect (path-scoped fingerprints) would silently invalidate every baseline entry at once, and nothing recorded that coupling. Now the dependency is written where the person changing the invocation will read it, together with the toml-vs-baseline split (fixtures → commit-independent .gitleaks.toml; genuine exposure → baseline + #1355 rotation).

Sibling PRs landing under the same ticket roll the allowlists out to 7 repos.

Part of tracebloc/backend#1404.

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only; no changes to gitleaks invocation, baselines, or CI behavior.

Overview
Comment-only change in the shared code-quality workflow’s gitleaks step: adds inline documentation that all scan paths use gitleaks git (commit-scoped) and that per-repo baseline suppressions only work with that mode because fingerprints include the introducing commit SHA.

The comment warns that switching any branch to gitleaks dir/detect would invalidate fleet baselines in one run (~277 suppressions per backend#1404 §4), and clarifies the split between commit-independent.gitleaks.toml allowlists for fixtures vs baselines for genuine historical exposure (rotation tracked in backend#1355).

No workflow behavior changes — scan commands and flags are unchanged.

^{Reviewed by Cursor Bugbot for commit 6ded637. Bugbot is set up for automated code reviews on this repo. Configure here.}