secret-scan: fail-closed dedup range, merge-base anchor, mrkdwn escaping

[Abdelsalam-Abbas]

Manual sync of Astera-org/github-workflows#6 (post-merge review fixes to #3). See that PR for full rationale.

• Validate the dedup scan range up front and fall back to full-history alerting on any doubt (gitleaks exits 0 on an unresolvable range, so this previously dropped alerts silently).
• Anchor the range on merge-base(origin/base, head) instead of the stale event base.sha, so merging the base branch into a PR no longer re-attributes its findings.
• Default notify_count to 0 (zero-byte report previously failed the step under set -e).
• Entity-escape Slack mrkdwn in sample lines (crafted file names could render as disguised links).
• Skip the incremental scan when no Slack token is present; clearer skip log line.