CLI command (TS and Go)
filter gitleaks
The same JSON output as filter-gitleaks-output.mjs.
Implements the same line-bound exception check, so it calls git and needs the cwd at the scanned repository root.
The three-way equivalence test compares its stdout bytes and exit code with the .mjs filter.