Ubuntu's gitleaks 8.16 package has no git subcommand, so the hook's "unknown command" exit 1 blocked every commit as a leak. Probe gitleaks git --help once, fall back to protect --staged; regenerate the installed hooks. T16c simulates a missing binary with a /usr/bin symlink farm minus gitleaks instead of a shorter PATH.