build: add lint target

ober

6cd85b5c2edfdc4bd7363439c9ef79ca11e3388e

diff --git a/Makefile b/Makefile
index d255ad4..e26bf26 100644
--- a/Makefile
+++ b/Makefile
@@ -146,6 +146,13 @@ audit:
 	  exit 1; \
 	fi
 
+.PHONY: lint
+lint:
+	@pattern="(BEGIN (RSA|OPENSSH|EC|DSA|PRIVATE) KEY|ghp_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{20,}|gldt-[A-Za-z0-9_-]{20,}|glrt-[A-Za-z0-9_-]{20,}|AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16})"; \
+	matches=$$(git grep -n -I -E "$$pattern" -- . ':!*.png' ':!*.jpg' ':!*.jpeg' ':!*.gif' ':!*.so' ':!*.dylib' ':!*.o' ':!*.a' ':!*.boot' ':!*.tar.gz' || true); \
+	if [ -n "$$matches" ]; then printf '%s\n' "$$matches" >&2; echo "lint: high-confidence secret pattern found" >&2; exit 1; fi; \
+	echo "lint: secret scan OK"
+
 verify: security native-test test native-loader-regression audit
 
 security: dependency-lock-check