chore(ci): tighten lint, secret scan, and bundle audit

CI changes:
- check.yml: drop auto-commit step. CI now fails on shfmt drift instead
  of pushing formatting fixes into the contributor branch.
- test.yml: replace ad-hoc grep secret scan with SHA-pinned gitleaks
  action plus .gitleaks.toml allowlist for tests and app protection
  bundle patterns.
- bundle_audit.yml: monthly cron + manual dispatch running
  scripts/audit_bundle_drift.sh against macos-latest, reporting any
  /System/Applications bundle ID not covered by FAST / CRITICAL /
  DATA_PROTECTED lists.
- .golangci.yml: enable gosec (with documented G115/G204/G301/G302/G304/
  G306/G702/G703 excludes for system-tool domain) and unparam.

Code cleanup driven by the new linters:
- cmd/analyze/cache.go + analyze_test.go: drop dead maxAge parameter.
- cmd/status/metrics.go + metrics_network.go + test: drop dead pernic
  parameter and nil error return.
- scripts/check.sh: remove the fabricated "Optimization Score" reporter
  (54 lines of cargo-culted scoring that didn't reflect anything real).