Pre-receive hook docs: --log-opts misses pre-existing secrets in changed files

## Problem

The official pre-receive hook guidance recommends:

gitleaks git --log-opts="--all commitA..commitB"

This only scans **added lines** in the git diff (`git log -p`). If a file already contains a secret and a developer edits a different line in that file, the push passes undetected.

This is a documentation gap — users deploying pre-receive hooks don't know about this limitation until they discover it in production.

## Steps to reproduce

1. Create a repo with a pre-existing secret in file `config.yml`
2. Push a commit that edits a different line in `config.yml` (not the secret)
3. Run `gitleaks git --log-opts="--all oldrev..newrev"` on the push range
4. No finding is reported — the zombie secret is missed

## Expected behavior

The documentation should clearly state that `--log-opts` only scans additions in git history and does **not** scan pre-existing content in changed files. Users relying on pre-receive hooks for enforcement need to be aware of this.

## Environment

- gitleaks v8.18.4
- GitHub Enterprise Server pre-receive hook context

Start with the official pre-receive hook guidance that documents `gitleaks git --log-opts="--all commitA..commitB"`, then verify the behavior using the provided reproduction steps. Update the guidance to explain that this scans added lines in git history, not pre-existing secrets in changed files, and ensure the limitation is clear for enforcement users.

Written by the indexing model from the issue text.