[ianardee]

Description

Types of changes

• Docs change / refactoring / dependency upgrade
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Requires a change to the official Guide documentation.

[Copilot]

🟡 Changes recommended

Direct pushes to main can reach release creation without secret scanning because the shared scan was removed and its Betterleaks replacement runs only for pull requests.

1 open issue

• Restore secret scanning before main-branch releases · New

What changed in this PR

This PR moves pull-request secret scanning from the local static-analysis workflow to the shared Betterleaks workflow.

Changes:

• Adds a shared Betterleaks job and makes unit tests depend on both scanning and static analysis.
• Removes the local scanner, report upload, failure check, and full-history checkout configuration.

File	Description
.github/​workflows/​pull-request.yml	Adds shared Betterleaks scanning as a prerequisite for unit tests.
.github/​workflows/​_static-analysis.yml	Removes embedded scanning and documents the separate workflow.

_{Review effort: Balanced}