ci: delete duplicate CodeQL workflow + fix Gitleaks to use free CLI

Two fixes for the 5 failing PR checks:

1. Delete codeql.yml (removes 4 red checks).
   GitHub's default CodeQL setup (enabled in Security → Code scanning →
   Default setup) already runs the same 4-language analysis on every PR
   and passes. The workflow-file version was a duplicate with broken
   autobuild settings for c-cpp. With it gone, the default setup is the
   sole CodeQL runner — zero coverage lost.

2. Fix secret-scan.yml (removes 1 red check).
   gitleaks-action@v2 went commercial in 2023 and requires a paid
   license for GitHub organization accounts. Replaced with the gitleaks
   CLI directly (MIT-licensed, free, same scanning engine). Downloads
   gitleaks v8.21.2 binary and runs `gitleaks detect` against the full
   git history using the repo's .gitleaks.toml config. Same coverage,
   no license.

Final workflow set: pr-build.yml, release.yml, secret-scan.yml (3 files).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sanchitmonga22

.github/workflows/codeql.yml

@@ -7,6 +7,10 @@ name: Secret Scanning
 # API keys, tokens, and internal URLs. Uses the project-level
 # .gitleaks.toml for RunAnywhere-specific patterns on top of gitleaks'
 # built-in detectors.
+#
+# Uses the gitleaks CLI directly (MIT-licensed, free for all) instead of
+# gitleaks-action@v2 which requires a paid license for organization
+# accounts.
 # =============================================================================
 
 on:
@@ -28,8 +32,17 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Install Gitleaks CLI
+        run: |
+          GITLEAKS_VERSION=8.21.2
+          curl -sL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz gitleaks
+          sudo mv gitleaks /usr/local/bin/
+          gitleaks version
+
       - name: Run Gitleaks
-        uses: gitleaks/gitleaks-action@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITLEAKS_CONFIG: .gitleaks.toml
+        run: |
+          if [ -f .gitleaks.toml ]; then
+            gitleaks detect --source . --config .gitleaks.toml --redact --verbose
+          else
+            gitleaks detect --source . --redact --verbose
+          fi