fix(push): the per-repo secret-scan toggle now governs pushes, as its label claims #5621

Owner-approved (2026-09-02), unblocking the owner-requested Vapron full-history import.

The drift

The gates settings page has always described secretScanEnabled as "Regex + AI secret detection on every push". The merge-time gate honours it. The pre-receive hook read only the global secretScanOnPushDisabled kill switch and never consulted the per-repo setting — a toggle silently governing half of what it names. Same push/merge drift family as the allow-secret pragma that armed the 2026-09-01 outage.

How it surfaced

The push gate (correctly) rejected the Vapron import on secret-crypto.test.ts:123-124 — verified synthetic fixtures inside a test proving their crypto module refuses plaintext. Rewriting their commits to carry our pragma would fork them from their canonical history, so the sanctioned route is the toggle the UI already promises — and the only switch that actually worked was platform-wide: the wrong blast radius by exactly one platform.

The fix

• Hook consults getOrCreateSettings(repositoryId).secretScanEnabled; both switches ANDed.
• Fails closed, per-repo: any settings read failure keeps the scan on. The force-push resolution beside it fails open (a DB hiccup must not wedge a push) — the secret scan must not inherit that trade, because a hiccup silently disabling secret scanning is an outage that looks like nothing happened.
• Pinned: the consultation, the fail direction, the two-switch AND, and that the merge gate reads the same field so the toggle can't fork meaning again.

Operational sequence this enables

Toggle one repo off → push the import → toggle back on. Every repo's default, and this one's end state, remains scanning.

Verification

• 3 structural tests. Full suite: 5,489 pass / 11 fail — baseline.