fix(container): install gitleaks from release binaries on multi-arch CI

[matthew-on-git]

Summary

Scheduled Build and Publish Container run 33391871123 failed after 50m on build-and-push:

go install ... github.com/zricethezav/gitleaks/v8@v8.30.0
did not complete successfully: exit code: 1

Same SHA (00a4e64) succeeded the week before. Native go install of gitleaks v8.30.0 works on amd64; the failure is compiling it under QEMU for linux/arm64. GHA cache TTL is 7 days, so last Monday likely reused layers and this run rebuilt.

Change

Install pinned gitleaks v8.30.0 from official release tarballs (linux_x64 / linux_arm64) and verify SHA-256 against upstream checksums.txt. Official binaries are already version-stamped, so the -ldflags inject is no longer needed.

Verified locally:

• amd64 tarball checksum + gitleaks version → 8.30.0
• arm64 tarball checksum OK

Test Plan

• Local download + sha256 for amd64 and arm64
• amd64 binary executes gitleaks version
• CI Build and Publish Container on this branch (or after merge, next scheduled/manual run)

Closes #60