feat: add advisory EVM key liveness checks

[tnunamak]

Summary

• Keep Gitleaks as the authoritative full-commit-range scanner.
• Add an explicit, pinned pre-push bootstrap that works offline after setup and never overwrites another hook manager.
• Adapt the address derivation and chain-liveness work from vana-smart-contracts #69 into a second, advisory job in the same reusable workflow.
• Query the public Vana and Moksha RPC endpoints with derived addresses only. Private-key candidates do not leave the runner.

Safety

The reusable workflow and local hook use the exact reviewed policy commit. Setup verifies the Gitleaks release and installs it explicitly; a push never downloads code or tools. The hook refuses unpinned, modified, missing, or tampered policy/tool state. Existing hooks and core.hooksPath are left untouched.

The advisory job runs code and dependencies from the pinned policy checkout. RPC failures and malformed responses produce warnings; they cannot make the Gitleaks job pass.

This PR is a draft. It does not change branch protection or rulesets.

Validation

• Full Gitleaks and pre-push regression harness
• Offline and tamper-failure tests
• 17 deterministic liveness tests
• npm audit --omit=dev: zero vulnerabilities
• Bash syntax, workflow lint, diff checks, and Slopgate
• Independent adversarial review: pass