#2416: chore: add detect-secrets baseline and loc check

## Summary - add detect-secrets baseline for current repo state - run pnpm check:loc in CI checks matrix <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR adds a `detect-secrets` baseline for the current repository state, and introduces a new CI matrix task (`pnpm check:loc`) to enforce a TypeScript max-lines-per-file check. It also relaxes the default LOC threshold in `package.json` (500 → 3000) and updates the LOC checker script to support `--exclude` regex patterns. Overall these changes fit as CI hygiene and repo maintenance guardrails: the baseline enables repeatable secret scanning in CI, while `check:loc` adds a lightweight maintainability gate for TS/TSX files. <h3>Confidence Score: 4/5</h3> - This PR is generally safe to merge with low risk; changes are mostly CI/config updates. - Most changes are additive (new CI task, secret-scanning baseline) and the LOC checker script change is small and straightforward. The main concern is around the default exclusion regex possibly missing intended folders, which could lead to noisy CI failures rather than runtime bugs. - scripts/check-ts-max-loc.ts and .github/workflows/ci.yml <!-- greptile_other_comments_section --> <!-- /greptile_comment -->