fix(memory): probe gitleaks without shell builtin

[jbetala7]

Fixes #1545

Summary

• replace the shell-based command -v gitleaks availability check with a direct gitleaks version executable probe
• pass the current env explicitly to both gitleaks execFileSync calls so PATH overrides are honored under Bun
• add a regression with a fake gitleaks binary that proves the direct probe runs before detect

Collision checks

• searched issues and PRs for gitleaks, secretScanFile, gitleaks PATH, scan-secrets Windows, and command -v
• open PR fix(memory-helpers): handle gbrain >=0.25 doctor non-zero exit and schema_version 2 #1418 touches lib/gstack-memory-helpers.ts but targets gbrain doctor engine detection, not gitleaks availability
• open PR fix(gbrain): probe CLI without command builtin #1485 removes a similar command -v gbrain path, but does not cover gitleaks

Testing

• bun test test/gstack-memory-helpers.test.ts
• bun test test/gstack-memory-ingest.test.ts --test-name-pattern "scan-secrets"
• git diff --check