Pre-receive hook docs: --log-opts misses pre-existing secrets in changed files

Problem

The official pre-receive hook guidance recommends:

gitleaks git --log-opts="--all commitA..commitB"

This only scans added lines in the git diff (git log -p). If a file already contains a secret and a developer edits a different line in that file, the push passes undetected.

This is a documentation gap — users deploying pre-receive hooks don't know about this limitation until they discover it in production.

Steps to reproduce

1. Create a repo with a pre-existing secret in file config.yml
2. Push a commit that edits a different line in config.yml (not the secret)
3. Run gitleaks git --log-opts="--all oldrev..newrev" on the push range
4. No finding is reported — the zombie secret is missed

Expected behavior

The documentation should clearly state that --log-opts only scans additions in git history and does not scan pre-existing content in changed files. Users relying on pre-receive hooks for enforcement need to be aware of this.

Environment

• gitleaks v8.18.4
• GitHub Enterprise Server pre-receive hook context