fix(ci): remove leftover redundant trufflehog job from secret-scanner.yml

The inline `trufflehog:` job ran `trufflesecurity/trufflehog@main` with
`extra_args: --only-verified --fail`. The @main action now injects `--fail`
itself, so the job died at argument parsing ("flag \x27fail\x27 cannot be
repeated") BEFORE scanning anything — the secret scanner was providing zero
coverage.

The canonical rsr-template-repo secret-scanner.yml deliberately retired the
inline TruffleHog job as redundant: the pinned standards reusable runs
gitleaks + a Rust-secrets check, sufficient coverage at lower cost. This syncs
the repo to that canon; the working gitleaks `scan` job is untouched. Also
clears the `governance / Workflow security linter` finding (unpinned
trufflehog@main).

Verified: actionlint clean; reusable call intact; no trufflehog refs remain.
Proven green end-to-end on ochrance-framework#28.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -17,13 +17,3 @@ jobs:
       actions: read
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
     secrets: inherit
-  trufflehog:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@main
-        with:
-          extra_args: --only-verified --fail