Make the remaining pre-commit hooks pass, except markdownlint

.github/CONTRIBUTING.md

@@ -209,7 +209,9 @@ We welcome code contributions! Here are the types of contributions we're looking
 
 - Use `bash` (not `sh`)
 - Include shebang: `#!/bin/bash`
-- Use 4-space indentation
+- Use 2-space indentation. The shfmt hook in `.pre-commit-config.yaml`
+  (`shfmt -i 2 -ci -sr`) is the source of truth for formatting; run
+  `pre-commit run shfmt --files <script>` to apply it
 - Quote variables: `"$VARIABLE"`
 - Use `[[` instead of `[` for conditionals
 - Add comments for complex logic

.github/workflows/security.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7
         with:
-          fetch-depth: 0  # Full history for better secret detection
+          fetch-depth: 0 # Full history for better secret detection
 
       - name: TruffleHog Secret Scan
         uses: trufflesecurity/trufflehog@main

.pre-commit-config.yaml

@@ -52,7 +52,10 @@ repos:
     rev: v0.10.0
     hooks:
       - id: yamlfmt
-        args: [-formatter, "retain_line_breaks=true"]
+        # drop_merge_tag keeps `<<:` merge keys as written instead of
+        # `!!merge <<:`; scan_folded_as_literal keeps the line breaks of
+        # folded (>) scalars such as the vault entrypoint.
+        args: [-formatter, "retain_line_breaks=true,drop_merge_tag=true,scan_folded_as_literal=true"]
 
   # Markdown linting
   - repo: https://github.com/igorshubovych/markdownlint-cli