fix(ci): bump secret-scanner SHA pin to pick up comment-line exemption (#222)

## Summary

- Bumps `secret-scanner-reusable.yml` pin from `3e4bd4c` → `28fdf19`
(standards#236).
- No code change to `scripts/fix-hardcoded-secrets.sh` required: line 11
is a comment (`# Shell: PASSWORD="hardcoded"...`) and the new scanner's
comment-line exemption (layer 3) skips all lines where the leading
non-whitespace character is `#`. Documentation of patterns cannot be
real secrets.

## What changed in standards#236

The `shell-secrets` scanner job in the reusable gained four exemption
layers:
1. Inline pragma (`# scanner-allow: shell-secrets` or `# hypatia: allow
security_errors/secret_detected`) on same or preceding line.
2. `.shell-secrets-ignore` file support (gitignore-style path globs).
3. Automatic param-expansion skip (`${VAR:-}`, `${VAR:?}`, `$VAR`).
4. Comment-line skip (lines starting with `#` cannot hold real secrets).

## Test plan

- [x] Local smoke: `fix-hardcoded-secrets.sh` line 11 skips as comment
line.
- [ ] CI green on this PR (shell-secrets job should now pass on main).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: hyperpolymath <hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -15,5 +15,5 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@28fdf197963c898e6bb80053c74b8d886f1c189d
     secrets: inherit