Secret hygiene: rotate Linear key, purge history, add gitleaks

Context
- Linear API key appeared in history: commit 461c6d1… in .kilocode/mcp.json.

Tasks
- Rotate Linear key.
- Remove secret from git history (BFG or git filter-repo).
- Add gitleaks in CI and pre-push.
- Ensure .kilocode/mcp.json is ignored (done).

Acceptance Criteria
- History cleaned; Push Protection no longer blocks.
- Leaked key confirmed revoked.