infra: detect-secrets baseline + CI Debug/Release matrix

[incendiary]

Summary

• Adds .secrets.baseline generated by detect-secrets v1.5.0 (clean scan — no findings)
• Adds detect-secrets pre-commit hook (Yelp/detect-secrets v1.5.0, --baseline .secrets.baseline)
• Adds a detect-secrets CI step in ci.yml that runs pip install detect-secrets && detect-secrets scan --baseline .secrets.baseline
• Adds a configuration: [Debug, Release] matrix to the build job; both dotnet build and dotnet test now receive --configuration ${{ matrix.configuration }}
• Updates README roadmap: rows 9 and 10 marked ✅ Done; detect-secrets added to the pre-commit hooks table

Closes #6, closes #7

Test plan

• CI passes on this PR (gitleaks → detect-secrets → build Debug → build Release)
• Both matrix legs (Debug, Release) appear as separate check entries
• detect-secrets scan --baseline .secrets.baseline exits 0 on a clean tree
• Pre-commit hook runs locally with pre-commit run detect-secrets

🤖 Generated with Claude Code