security: re-pin secret scanner onto the real gitleaks gate

The caller pinned standards' secret-scanner-reusable at @d135b05
(2026-06-24), which is 64 commits behind standards#500. At that pin the
gitleaks step carries `continue-on-error: true` — the scan runs, reports
success, and cannot fail. This repo's Secret Scanner has therefore been
green while being incapable of failing.

Re-pinned to @c65436ee, which contains #500: gitleaks now runs as a
pinned, checksum-verified binary with `--exit-code 1` and gates for real.

Also narrowed the caller's grant to `contents: read`. The new reusable
invokes a binary rather than gitleaks-action, so it no longer requests
`pull-requests: write` / `actions: read`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -21,7 +21,5 @@ jobs:
     # startup_failure. See standards#472.
     permissions:
       contents: read
-      pull-requests: write
-      actions: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
     secrets: inherit