docs(checklist): rewrite Section 8 to match the actual .pre-commit-config.yaml

Previous Section 8 was inaccurate. It listed gitleaks as a key hook,
but gitleaks is NOT in the parent repo's .pre-commit-config.yaml -
it's mentioned only in the codebase-security-audit skill's CI
workflow reference. And it omitted lychee (the third actual repo in
the shipped config).

Also, ggshield runs OUTSIDE pre-commit-config.yaml as its own git
hook (you can see "ggshield detected... Running secret scan"
running before the pre-commit hooks in every commit log), so it
needs its own install steps, not a one-line mention buried in a
prose sentence about "key hooks".

New Section 8 mirrors reality:

- Tells the reader to copy the actual file (and .markdownlint.yaml,
  which markdownlint --config references)
- Table listing all three repos in the shipped config with their
  pinned revs, the hooks each one provides, and what each does
  (pre-commit-hooks v6.0.0 with eight hooks; markdownlint-cli v0.47.0
  with auto-fix; lychee nightly as a manual-stage link checker)
- Notes the file-specific excludes (trailing-whitespace skips *.md
  to preserve hard breaks; end-of-file-fixer skips *.mdc)
- Separate subsection for ggshield with brew/pipx install + ggshield
  auth login + ggshield install --mode local --type pre-commit
- Honest note that ggshield COMPLEMENTS detect-private-key (which
  only catches a small set of recognized key formats) rather than
  replacing it
- Cross-link to the codebase-security-audit skill for users who want
  gitleaks-grade coverage in CI rather than in pre-commit

No slop, no smart quotes, no em/en-dashes (verified post-write).

Author: d-padmanabhan

NEW_REPO_CHECKLIST.md

@@ -145,18 +145,41 @@ mkdir -p tmp/pr tmp/pr_reviews tmp/agent_reports tmp/bug_reports
 
 ## 8. Pre-commit hooks (recommended)
 
-Mirror this repo's pre-commit stack so your consumer repo gets the same secret-scanning + lint baseline.
+Mirror this repo's pre-commit stack so your consumer repo gets the same lint + safety baseline. The full config is at [`.pre-commit-config.yaml`](.pre-commit-config.yaml); copy it as-is.
 
 ```bash
 brew install pre-commit                                  # macOS
 # pip install pre-commit                                 # any platform
 
 cp /path/to/cursor-engineering-rules/.pre-commit-config.yaml .pre-commit-config.yaml
+cp /path/to/cursor-engineering-rules/.markdownlint.yaml   .markdownlint.yaml
 pre-commit install
 pre-commit run --all-files                               # baseline run
 ```
 
-Key hooks: `gitleaks`, `ggshield` (secret scanning), `pre-commit-hooks` (trailing whitespace, large files, private keys, mixed line endings), `markdownlint`.
+Hooks in the shipped config:
+
+| Repo | Hook(s) | Purpose |
+|---|---|---|
+| `pre-commit/pre-commit-hooks` v6.0.0 | `trailing-whitespace` (excludes `*.md`), `end-of-file-fixer` (excludes `*.mdc`), `check-yaml`, `check-added-large-files` (1 MB cap), `mixed-line-ending` (forces LF), `check-case-conflict`, `check-merge-conflict`, `detect-private-key` | File hygiene + obvious safety |
+| `igorshubovych/markdownlint-cli` v0.47.0 | `markdownlint` with `--fix --config .markdownlint.yaml` | Markdown style enforcement (auto-fixes most issues) |
+| `lycheeverse/lychee` nightly | `lychee` (stage: `manual`, files: `*.md` / `*.mdc`) | Link checker - run on demand: `pre-commit run lychee --hook-stage manual` |
+
+### Secret scanning (separate from `.pre-commit-config.yaml`)
+
+`ggshield` (GitGuardian) installs as its own git hook and runs **before** pre-commit-config.yaml. Install per-repo:
+
+```bash
+brew install gitguardian/tap/ggshield                    # macOS
+# pipx install ggshield                                  # any platform
+
+ggshield auth login                                      # one-time
+ggshield install --mode local --type pre-commit          # per-repo
+```
+
+`ggshield` complements the config's `detect-private-key` (which only catches a small set of recognized key formats) with full GitGuardian secret detection.
+
+For broader regex + entropy coverage (CI-grade), wire `gitleaks` into your GitHub Actions workflow instead of pre-commit; see the [`codebase-security-audit` skill's CI workflow reference](skills/codebase-security-audit/references/ci-workflow.md).
 
 ## 9. Git hygiene