security: re-pin secret scanner onto the real gitleaks gate

[hyperpolymath]

This repo's Secret Scanner has been reporting success while being incapable of failing.

The caller pinned secret-scanner-reusable at @d135b05 (2026-06-24) — 64 commits behind standards#500. At that pin the step is literally:

- name: Gitleaks Secret Scan
  continue-on-error: true          # <- cannot fail
  uses: gitleaks/gitleaks-action@e0c47f4f...

Re-pinned to @c65436ee (contains #500 — compare reports ahead 5 / behind 0):

- name: Install gitleaks (pinned + checksum-verified)   # sha256-verified binary
- name: Gitleaks secret scan (gating)
  run: ... gitleaks detect ... --exit-code 1            # gates for real

Also narrowed the caller's grant to contents: read — the new reusable invokes a binary rather than gitleaks-action, so it no longer requests pull-requests: write / actions: read. (That mismatch is what startup_failured standards' own scanner; see standards#511.)

Verified before opening: gitleaks detect --exit-code 1 passes on this tree.

Part of the estate-wide sweep of ~200 repos still on the pre-#500 pin.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml	c65436ee3351cd6b0fa14b142938b195efc77586	🟢 6	Details Check Score Reason Code-Review ⚠️ 0 Found 0/24 approved changesets -- score normalized to 0 Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 30 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 7 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 SAST 🟢 9 SAST tool detected but not run on all commits License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found Vulnerabilities ⚠️ 0 11 existing vulnerabilities detected Fuzzing 🟢 10 project is fuzzed Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6 CI-Tests 🟢 10 25 out of 25 merged PRs checked by a CI test -- score normalized to 10

Scanned Files

• .github/workflows/secret-scanner.yml