Doc: note gitleaks + git-crypt arrive via opencode-devbox base

No Dockerfile install change here — pi-devbox FROMs joakimp/opencode-
devbox:base-latest which gained gitleaks (and explicit acknowledgment
of git-crypt) in opencode-devbox commit adding both to the base layer.
The next pi-devbox release built against a fresh base-latest digest
inherits both with zero work on this side.

CHANGES

Dockerfile — comment block at top updated to name git-crypt + gitleaks
in the 'inherited from base' toolset enumeration. Helps future
readers: one less reason to think 'I need to install gitleaks here'.

CHANGELOG.md — new Unreleased entry pointing at the opencode-devbox
base-side change for full detail. Will be promoted whenever the next
pi-devbox release ships (probably alongside the next pi npm bump past
0.75.5).

Holding off on tagging — pi upstream still at 0.75.5, baseline release
v0.75.5b is already current with that. Will ride along with next pi
bump.

Dockerfile

@@ -2,7 +2,8 @@
 #
 # Builds on top of the opencode-devbox base image, which provides:
 #   Debian trixie, Node.js, AWS CLI, mempalace + MCP server, gitea-mcp,
-#   dev tools (neovim, tmux, bat, eza, fzf, zoxide, ripgrep, uv, rustup),
+#   dev tools (neovim, tmux, bat, eza, fzf, zoxide, ripgrep, uv, rustup,
+#   git-crypt, gitleaks),
 #   user setup (developer/gosu), entrypoints, chromadb prewarm.
 #
 # This image adds only pi itself and its companion repos.