experiment(exp/scan-only): isolate secret-scanner startup_failure

Diagnostic branch. Bisecting a startup_failure that has left this repo with no
secret scanning since 2026-07-17. Will be deleted once the cause is known.

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -3,7 +3,7 @@ name: Secret Scanner
 on:
   pull_request:
   push:
-    branches: [main]
+    branches: [main, 'exp/**']
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -13,17 +13,5 @@ jobs:
   scan:
     permissions:
       contents: read
-      pull-requests: write
-      actions: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
     secrets: inherit
-  trufflehog:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@main
-        with:
-          extra_args: --only-verified --fail