TEST ONLY — verify two-pass gitleaks CI (do not merge)

[fitz123]

Draft to validate that fitz123/claude-code-bot#126 (two-pass gitleaks
workflow) actually runs end-to-end in CI when called by bb-dpi.

The only change in this PR is repointing pii-scan.yml at the
@gitleaks-scan-commit-messages ref of the reusable workflow.

Expectation: the PII Scan check should report TWO steps:

1. existing gitleaks/gitleaks-action@v2 (diffs)
2. new Scan commit messages for PII

Both must succeed (this PR's commit message is clean).

Will close + delete the branch once CI confirms behavior — DO NOT MERGE.

[fitz123]

Validation complete: the new commit-message scan step ran and reported 'no leaks found' on the clean test message. The CI failure is from gitleaks-action@v2 (diff scan) catching a false positive on '@gitleaks' from the temporary 'uses: ...@gitleaks-scan-commit-messages' pin in this branch — pre-existing telegram-handles rule, not from this PR's new code. Real merged state (@main) won't trigger it.