ci: install Lean via elan in ECHIDNA + drop duplicate trufflehog --fail

Two follow-on CI reds surfaced after #159 merged to main:

1. ECHIDNA 'Install proof provers' still failed with apt exit 100 —
   Ubuntu 24.04 (noble) packages neither 'lean' nor 'isabelle'. Install
   Lean 4 via elan (pinned to v3.1.1 + sha256-verified, matching
   lean-verification.yml); keep coq/agda/z3 from apt. Isabelle stays
   absent and validate-with-echidna.sh SKIPs it.

2. Secret Scanner: the reusable scan/* jobs now pass (permissions fix in
   #159 worked), but the separate 'trufflehog' job failed with
   'flag "fail" cannot be repeated' — the trufflehog action injects
   --fail itself, so extra_args must not repeat it. Now passes
   '--only-verified' only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/echidna-validation.yml

@@ -51,18 +51,20 @@ jobs:
           echo "/tmp/echidna/target/release" >> $GITHUB_PATH
 
       - name: Install proof provers
-        # `isabelle` is not packaged in Ubuntu 24.04 (noble); requesting it
-        # fails the whole job with apt exit 100. validate-with-echidna.sh
-        # reports SKIP for absent provers, so Isabelle proofs are skipped
-        # rather than blocking the pipeline.
+        # Ubuntu 24.04 (noble) packages neither `lean` nor `isabelle`, and
+        # apt-get exits 100 on any unknown package. Lean 4 comes via elan
+        # (pinned + checksum-verified, same as lean-verification.yml).
+        # Isabelle stays uninstalled; validate-with-echidna.sh reports SKIP
+        # for absent provers rather than failing.
         run: |
           set -euo pipefail
           sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            lean \
-            coq \
-            agda \
-            z3
+          sudo apt-get install -y --no-install-recommends coq agda z3
+          curl -sSfL https://raw.githubusercontent.com/leanprover/elan/v3.1.1/elan-init.sh -o elan-init.sh
+          echo "f5d473c923c093759ae3839073bec2a58e82cb8bc0e4083930e76090da75b310  elan-init.sh" | sha256sum -c -
+          sh elan-init.sh -y
+          rm -f elan-init.sh
+          echo "$HOME/.elan/bin" >> $GITHUB_PATH
 
       - name: Verify ECHIDNA available
         run: echidna list-provers

.github/workflows/secret-scanner.yml

@@ -30,4 +30,7 @@ jobs:
       - name: TruffleHog Secret Scan
         uses: trufflesecurity/trufflehog@00155c9dc586f34d189adc83d3ac2698c2ec551f # v3.93.3
         with:
-          extra_args: --only-verified --fail
+          # The action already appends `--fail` internally; repeating it here
+          # makes the trufflehog binary abort with "flag 'fail' cannot be
+          # repeated". Pass only `--only-verified`.
+          extra_args: --only-verified