fix: Use POSIX redirect in pre-commit gitleaks guard

`&> /dev/null` is a bashism. Husky runs hooks under `/bin/sh`, so on
systems where that is dash the guard parsed as a backgrounded
`command -v gitleaks &` followed by a bare `> /dev/null` redirection,
whose exit status is always 0. That made the `if` always true, so
`gitleaks protect` ran even when gitleaks was not installed and the
warning branch was unreachable.

This was failing on CI with Linux runners.

Author: homin-bt

.husky/pre-commit

@@ -1,5 +1,5 @@
 # Check for secrets in staged files before committing
-if command -v gitleaks &> /dev/null; then
+if command -v gitleaks >/dev/null 2>&1; then
   gitleaks protect --staged --redact --no-banner
 else
   echo "WARNING: gitleaks not installed — skipping secret scan. Install via: brew install gitleaks"