Adds core.hooksPath pointing at dotfiles-managed hooks. The hook runs gitleaks on staged changes and chains to any repo-local pre-commit hook so per-repo hooks are not silently skipped.