merge main: keep the workflow valid

Conflict is main's two invalid constructs, both kept removed on this branch:

  * a duplicated `secrets: inherit` key. GitHub Actions rejects duplicate
    keys outright; Python's yaml.safe_load accepts them (last wins), so local
    linting never caught it.
  * the inline trufflehog job, which creates ZERO jobs and startup_failures
    the whole run (bisected on http-capability-gateway).

Either alone is enough to stop this workflow existing as far as Actions is
concerned — the tell was the Actions API reporting
name == '.github/workflows/secret-scanner.yml' instead of 'Secret Scanner',
which is how GitHub registers a file it cannot parse.

Verified: passes a strict YAML load that rejects duplicate keys AND rejects an
empty/jobless file (a vacuous pass is not a pass).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/boj-build.yml

@@ -10,7 +10,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         run: |
           # Send a secure trigger to boj-server to build this repository

.github/workflows/casket-pages.yml

@@ -17,7 +17,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
 
       - name: Setup Pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

.github/workflows/codeql.yml

@@ -33,7 +33,7 @@ jobs:
             build-mode: none
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v3

.github/workflows/pages.yml

@@ -18,9 +18,9 @@ jobs:
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
       - name: Checkout Site
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
       - name: Checkout Ddraig SSG
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg

.github/workflows/registry-validate.yml

@@ -32,7 +32,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Julia
         uses: julia-actions/setup-julia@fa02766e078afaaf09b14210362cee14137e6a32 # v3.0.2