ci: add first-ever build/vet/test + gitleaks CI (ADR-KV-014)

lib is publicly mirrored on code.tnxs.net and had no CI at all. Add
.github/workflows/push.yml gating every push/PR on the private
self-hosted runner (ADR-KV-004): a test job (go build/vet/test) and a
gitleaks secret-scan job using the official docker image directly
(gitleaks/gitleaks-action needs an org license we don't have).

The gitleaks history scan surfaced 6 findings, all illustrative
`example:` JWTs hardcoded by swagger-codegen into the generated Kazoo
API client models and the vendored Kazoo swagger spec — placeholders
from the vendor's public docs, not real credentials. Added a minimal
.gitleaks.toml allowlist scoped to just those four generated files so
CI runs clean without masking real findings elsewhere.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/push.yml

@@ -0,0 +1,51 @@
+name: CI (lib)
+
+# First-ever CI for go/lib (ADR-KV-014). lib is publicly mirrored on
+# code.tnxs.net, so every push and PR gets a build/vet/test job plus a
+# gitleaks secret-scan job. lib is a Go library — no Dockerfile, no deploy.
+on:
+  push:
+    branches: ['**']
+  pull_request:
+
+defaults:
+  run:
+    shell: bash
+
+# Serialize per ref. PR runs cancel superseded validations; branch pushes never cancel.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  test:
+    runs-on: [self-hosted, Linux]
+    permissions: { contents: read }
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version: stable
+
+      - name: go build ./...
+        run: go build ./...
+
+      - name: go vet ./...
+        run: go vet ./...
+
+      - name: go test ./...
+        run: go test ./...
+
+  gitleaks:
+    runs-on: [self-hosted, Linux]
+    permissions: { contents: read }
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
+
+      - name: gitleaks detect (git history)
+        run: |
+          docker run --rm -v "$PWD:/repo" -w /repo zricethezav/gitleaks:latest \
+            detect --source /repo --redact -v

.gitleaks.toml

@@ -0,0 +1,20 @@
+title = "gitleaks config for code.tnxs.net/vernonkeenan/lib"
+
+[extend]
+useDefault = true
+
+# ADR-KV-014: first-ever CI gitleaks scan surfaced 6 findings, all in
+# swagger-codegen-generated Kazoo API client models and the vendored
+# Kazoo swagger spec. Each is an illustrative `// Example:` / `example:`
+# JWT hardcoded by the generator to document the shape of an auth_token
+# field — a placeholder from the vendor's public API docs, not a
+# credential issued to or used by this project. Scoped narrowly to the
+# four generated files that triggered, not repo-wide.
+[allowlist]
+description = "Generated Kazoo API client/swagger example JWTs (not real secrets)"
+paths = [
+  '''api/kazoo/kazoo_models/get_account_descendent_response\.go''',
+  '''api/kazoo/kazoo_models/get_account_callflow_response\.go''',
+  '''api/kazoo/kazoo_models/get_account_response\.go''',
+  '''swagger/kazoo-telnexus\.yaml''',
+]