fix(ci): arm code-quality — gitleaks was a required check that could not fail (backend#1681)

[LukasWodka]

What

Sets soft-fail: false on this repo's code-quality caller.

Why this is a real gap, not tidying

soft-fail defaults to true, so every job in this caller — gitleaks, house-rules, action-pins — reported its findings and then exited 0. On this repo quality / gitleaks and quality / house-rules are required status checks. They were required checks that could not fail: a genuine secret could be flagged and the PR would still be green and mergeable.

Found by the round-2 pipeline audit (backend#1681), which measured this across the fleet: 12 of 16 repos pass soft-fail: false; this repo was one of four that did not.

Why it is safe to arm now

• The deferring comment pointed at backend#1303 ("flip code-quality to required per repo once its backlog is clean") — that issue closed 2026-07-31.
• I measured the most recent run on this repo before flipping: zero real findings for gitleaks, house-rules and action-pins. The only annotations present are GitHub's platform-level "Node.js 20 is deprecated" notice, which is not a code-quality finding.
• python/shell are false here, so ruff/shellcheck/format are skipped and unaffected.

So this arms a check that is already green rather than importing a backlog.

Also fixed

The comment claiming the pin check is "Independent of soft-fail above" — there is no soft-fail above it, and under the shared reusable's current OR-expression that claim was false. (The expression itself is fixed separately in tracebloc/.github#207; this PR is correct either way, since both inputs are now false.)

Parent epic: backend#1680.

---

Note

Low Risk
Workflow-input-only change that tightens CI enforcement; no application or data-path changes, and checks were already green before arming.

Overview
Sets soft-fail: false on the reusable code-quality workflow caller so gitleaks, house-rules, and related jobs fail the check when they report findings instead of exiting 0 under the previous default.

Comments are updated to record backend#1681: required status checks on this repo were effectively advisory until now; recent runs showed no backlog, so arming does not block merges on existing noise. The action-pins comment is corrected to note that pin enforcement is tied to the same soft-fail posture, not independent of it.

^{Reviewed by Cursor Bugbot for commit 2ab036d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[shujaatTracebloc]

Arms code-quality: soft-fail flipped to false so gitleaks + house-rules — which are REQUIRED status checks here — can actually fail instead of reporting findings and exiting 0 (a required check that could not fail). Justified: backend#1303 closed 2026-07-31 and the latest run shows zero real findings, so this keeps a green check green rather than importing a backlog; also fixes the missing EOF newline. Green, no threads. LGTM.