fix(hooks): use 'gitleaks git --staged' (v8.30 syntax)

'gitleaks protect' is the deprecated alias. Both work today, but the
deprecated form will eventually be removed and the failure mode is a
silently non-functioning secret gate — worse than no gate, because it
is trusted.

Verified end-to-end: staging a file containing a Supabase service-role
JWT and a GitHub PAT causes the pre-commit hook to exit 1 and block the
commit.

Refs C-03

lefthook.yml

@@ -3,7 +3,7 @@ pre-commit:
   parallel: true
   commands:
     gitleaks:
-      run: gitleaks protect --staged --no-banner --redact
+      run: gitleaks git --staged --no-banner --redact
     no-large-files:
       run: |
         git diff --cached --name-only --diff-filter=A | while read -r f; do