fix(container): secret-scan the current tree before the build, verbose and redacted

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/container.yaml

@@ -113,10 +113,6 @@ jobs:
           </settings>
           EOF
 
-      - name: Test and build
-        shell: bash
-        run: ${{ inputs.prebuild }}
-
       - name: Install scanners
         shell: bash
         run: |
@@ -130,9 +126,14 @@ jobs:
           echo /tmp/tools >> "$GITHUB_PATH"
 
       - name: Secret scan
+        # Current source tree before the build (history findings belong to rotation, not to every release).
         if: env.PUBLISH == 'true'
         shell: bash
-        run: gitleaks detect --source . --redact --no-banner
+        run: gitleaks detect --no-git --source . --redact --no-banner --verbose
+
+      - name: Test and build
+        shell: bash
+        run: ${{ inputs.prebuild }}
 
       - name: Build and scan images
         shell: bash