security: drop the local trufflehog job — it startup_failures the whole run

Bisected on http-capability-gateway 2026-07-21 with two isolation branches:

  exp/scan-only        (reusable only)  -> 3 jobs created, run executes
  exp/trufflehog-only  (trufflehog only) -> 0 jobs created, startup_failure

startup_failure means no job is ever created, so the Secret Scanner has been
reporting nothing at all — not a red, an absence. This repo has had no secret
scanning since the pin landed. A required check that never reports is
indistinguishable from one still running, which is why this went unnoticed.

The action is allowlisted (`trufflesecurity/trufflehog@*` is in
patterns_allowed, github_owned_allowed=true), so this is not an Actions-policy
rejection; the reference itself fails to resolve at run creation.

Removing it loses no coverage: standards' secret-scanner-reusable dropped
trufflehog deliberately ("Trufflehog removed: gitleaks provides sufficient
coverage at lower cost"), and the reusable's gitleaks + rust-secrets +
shell-secrets jobs now run for real on this repo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -15,13 +15,3 @@ jobs:
       contents: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
     secrets: inherit
-  trufflehog:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@main
-        with:
-          extra_args: --only-verified --fail