docs: describe what the scan does on manual dispatch

[altaywtf]

docs/DISTRIBUTION.md said a manual dispatch has Actionlint and Zizmor audit "the full history". They lint every workflow in the current tree; full history is what Gitleaks scans, and the shared scan leaves Gitleaks off for public repositories.

-Actionlint and Zizmor audit when a `main` push changes workflows, or of the
-full history on manual dispatch.
+Actionlint and Zizmor audit when a `main` push changes workflows and on manual
+dispatch. GitHub secret scanning and push protection cover secrets in this
+public repository.

• The secret-scanning sentence matches the repository's live settings (secret scanning and push protection both on).
• docs: publishes nothing.

---

Written by an agent (Claude Code, Claude Opus 5.5)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.