chore: fleet audit — security, governance, and quality fixes (#1)

* fix: Dockerfile CMD path and chown for Docker proxy support

* chore: remove legacy codeql.yml (ADR-011 GHAS migration)

* chore: remove legacy gitleaks.yml (ADR-011 GHAS migration)

* docs: add TOOLS.md with tool documentation

.github/workflows/codeql.yml

@@ -1,42 +0,0 @@
-name: "CodeQL Security Analysis"
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  schedule:
-    # Run weekly on Monday at 6 AM UTC
-    - cron: '0 6 * * 1'
-
-jobs:
-  analyze:
-    name: Analyze Code
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ['javascript']
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: ${{ matrix.language }}
-          queries: security-extended # More thorough than default
-
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
-        with:
-          category: "/language:${{matrix.language}}"

.github/workflows/gitleaks.yml

@@ -1,30 +0,0 @@
-name: Secret Scanning (Gitleaks)
-
-on:
-  push:
-    branches: ['**']
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  scan:
-    name: Scan for secrets
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0  # Full history for accurate scanning
-
-      - name: Install Gitleaks
-        run: |
-          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.0/gitleaks_8.30.0_linux_x64.tar.gz | tar -xz
-          sudo mv gitleaks /usr/local/bin/
-
-      - name: Run Gitleaks
-        run: gitleaks detect --source . --verbose