fix(ci): trufflehog action injects --fail itself — drop the duplicate (#64)

Last red on Secret Scanner after #63: the SHA-pinned trufflehog action
(v3.95.6) injects `--fail` internally, so the repo job's `extra_args:
--only-verified --fail` dies with `flag 'fail' cannot be repeated` (the
old unpinned `@main` predated the injection). `--results=verified`
replaces the deprecated `--only-verified`; fail-on-verified-findings
behavior is unchanged.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -28,4 +28,4 @@ jobs:
       - name: TruffleHog Secret Scan
         uses: trufflesecurity/trufflehog@30d5bb91af1a771378349dbbb0c82129392acf70 # v3.95.6
         with:
-          extra_args: --only-verified --fail
+          extra_args: --results=verified