build: add missing security/lint targets

ober

abef43ca0557dfcd3868b97ec60966792c5b58ae

diff --git a/Makefile b/Makefile
index 0e81334..8b79c25 100644
--- a/Makefile
+++ b/Makefile
@@ -94,7 +94,7 @@ PODMAN ?= podman
         jerboa-yubikey-lib check-yubikey-lib-fresh \
         yubikey-native-linux-amd64 yubikey-native-linux-arm64 \
         vendor-deps vendor-deps-linux vendor-native-rs vendor-native-rs-pruned \
-        install install-binary install-shims learn-codex-shim lint
+        install install-binary install-shims learn-codex-shim lint security
 
 all: ffi jerboa compile
 
@@ -1039,6 +1039,14 @@ check-platforms:
 lint:
 	@sh support/security-policy-check.sh
 
+security:
+	@echo "==> security: high-confidence secret scan"
+	@if git grep -nIE '(AKIA[0-9A-Z]{16}|-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----|aws_secret_access_key|GH_TOKEN|sk-[A-Za-z0-9]{20,})' -- ':!vendor' ':!*.lock' ':!test*' ':!Makefile' ':!*.md' ':!.gitsafe.json' ':!.github' ':!shims' 2>/dev/null; then \
+		echo "SECURITY: potential secret detected" >&2; exit 1; \
+	else \
+		echo "security: no high-confidence secrets found"; \
+	fi
+
 install-hooks:
 	@if [ ! -d .git ]; then echo "not a git checkout — cannot install hooks" >&2; exit 1; fi
 	@mkdir -p .git/hooks