- Quote $CONFIG_ARG in pre-commit and pre-push to prevent word-splitting
on paths with spaces or special characters
- Add `git rev-parse HEAD` guard in pre-push so gitleaks is skipped on
repos with no commits yet (gitleaks git exits non-zero on empty history)
- Expand pre-push header comment to document the empty-repo skip and note
the full-history scan tradeoff for large repos
