sec: regenerate .secrets.baseline to clear detect-secrets CI failure

.github/workflows/ci.gitleaks.yml

@@ -33,6 +33,11 @@ jobs:
           tar -xzf "gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" gitleaks
           sudo mv gitleaks /usr/local/bin/gitleaks
 
+      # No --baseline-path: that mechanism required a committed JSON report
+      # containing real Match/Secret values to match against, which is unsafe
+      # to store in the repo. Suppression of known findings is handled instead
+      # by .gitleaksignore (fingerprints only, no secret content) and
+      # .gitleaks.toml (path-based allowlist for the baseline metadata files).
       - name: Run gitleaks
         id: gitleaks
         continue-on-error: true
@@ -41,7 +46,7 @@ jobs:
             --source . \
             --log-opts="--all" \
             --redact \
-            --baseline-path .gitleaks-baseline.json \
+            --config .gitleaks.toml \
             --report-format sarif \
             --report-path gitleaks-results.sarif \
             --exit-code 1