fix(ci): bump secret-scanner SHA pin + scanner-allow pragma on test fixture (#377)

## Summary

- Bumps `secret-scanner-reusable.yml` pin from `3e4bd4c` → `28fdf19`
(standards#236).
- Adds `# scanner-allow: shell-secrets` pragma above `export
ARANGODB_PASSWORD="testpassword"` in `integration/run-tests.sh`.
- `hooks/lib/cache.sh` line 22
(`CICD_CACHE_PASSWORD="${CICD_CACHE_PASSWORD:-}"`) now passes
automatically via the new param-expansion exemption — no code change
needed there.

## What changed in standards#236

The `shell-secrets` scanner job in the reusable gained four exemption
layers:
1. Inline pragma (`# scanner-allow: shell-secrets` or `# hypatia: allow
security_errors/secret_detected`) on same or preceding line.
2. `.shell-secrets-ignore` file support (gitignore-style path globs).
3. Automatic param-expansion skip (`${VAR:-}`, `${VAR:?}`, `$VAR` — not
literals).
4. Comment-line skip (lines starting with `#` cannot hold real secrets).

## Test plan

- [x] Local smoke: all three false-positive lines skip cleanly with the
new scanner logic.
- [ ] CI green on this PR (shell-secrets job should now pass on main).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -15,5 +15,5 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@28fdf197963c898e6bb80053c74b8d886f1c189d
     secrets: inherit

integration/run-tests.sh

@@ -264,7 +264,7 @@ run_tests() {
     export ARANGODB_URL="http://localhost:8529"
     export ARANGODB_DATABASE="cicd_hyper_a_test"
     export ARANGODB_USERNAME="root"
-    # See note above re: `testpassword` being the documented fixture, not a real secret.
+    # scanner-allow: shell-secrets -- test fixture, not a real credential
     export ARANGODB_PASSWORD="testpassword"
     export DRAGONFLY_URL="redis://localhost:6379"
     export RUST_LOG="${RUST_LOG:-info}"