Extract secrets:check to scripts/secrets-check.sh and roll out to 23 packages

Part of ALL-883. Mirror the pattern landed in #10455. Audit: 23 package.json files contain a `secrets:check` script entry. Steps: 1. Branch: rob/all-883-extract-secrets-check off main (after #10455 + onboardbase-delete merged) 2. Create scripts/secrets-check.sh with the canonical body (look at #10455 for the form — set -euo pipefail, doppler invocation, exit non-zero on missing required vars) 3. Replace the inline body in each of the 23 package.json files with: `bash ../../scripts/secrets-check.sh` (adjust depth per package location) 4. shellcheck the script 5. Test locally in 2-3 representative packages (one shallow, one nested) 6. Open PR 'ALL-883: Extract secrets:check to shared script', body links ALL-883 Gated on: #10455 + onboardbase-delete PR merged.