fix(ci): provision real ripgrep for secret-scanner workflow checks

Verify PCRE2 on every hosted test platform and coverage runner. Preserve dependency PATH for real scanner delegates and report missing prerequisites explicitly, keeping production fail-closed behavior and hermetic missing/error controls intact.

.github/workflows/ci.yml

@@ -44,6 +44,36 @@ jobs:
         with:
           node-version: ${{ matrix.node }}
 
+      - name: Install and verify ripgrep (Linux)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y ripgrep
+          rg --version
+          printf 'ecc-pcre2-probe\n' | rg --pcre2 -- '^ecc-pcre2-probe$'
+
+      - name: Install and verify ripgrep (macOS)
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          if ! command -v rg >/dev/null 2>&1; then brew install ripgrep; fi
+          rg --version
+          printf 'ecc-pcre2-probe\n' | rg --pcre2 -- '^ecc-pcre2-probe$'
+
+      - name: Install and verify ripgrep (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          if (-not (Get-Command rg -ErrorAction SilentlyContinue)) {
+            choco install ripgrep --yes --no-progress
+            if ($LASTEXITCODE -ne 0) { throw 'ripgrep installation failed' }
+          }
+          rg --version
+          if ($LASTEXITCODE -ne 0) { throw 'ripgrep executable is unavailable' }
+          'ecc-pcre2-probe' | rg --pcre2 -- '^ecc-pcre2-probe$'
+          if ($LASTEXITCODE -ne 0) { throw 'ripgrep PCRE2 support is required' }
+
       # Package manager setup
       - name: Setup pnpm
         if: matrix.pm == 'pnpm' && matrix.node != '18.x'
@@ -362,6 +392,13 @@ jobs:
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
+      - name: Install and verify ripgrep
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y ripgrep
+          rg --version
+          printf 'ecc-pcre2-probe\n' | rg --pcre2 -- '^ecc-pcre2-probe$'
+
       - name: Run coverage
         run: npm run coverage