fix(ci): restore megalinter gate on main (hadolint, editorconfig, trufflehog) (#286)

* fix(ci): restore megalinter gate on main (hadolint, editorconfig, trufflehog)

Megalinter has been red on main since the v10 image / trufflehog 3.96
toolchain drift. Three independent findings, fixed at the source:

1. hadolint DL3066 (Dockerfile:32): use numeric UID (USER 1000) — the
   user is created with --uid 1000 a few lines above.
2. editorconfig-checker: docs/TROUBLESHOOTING.md contained mixed CRLF/LF
   line endings (introduced via PR #285); normalized to LF per
   .editorconfig (end_of_line = lf).
3. trufflehog >=3.96 Lob detector flags every `test_*` function name as a
   verified Lob key (Lob test keys share the `test_` prefix). Excluded
   only the Lob detector via REPOSITORY_TRUFFLEHOG_ARGS so all other
   secret detectors stay active. Verified locally: 0 findings with
   trufflehog 3.96.0 after exclusion.

Validation:
- trufflehog 3.96.0 --only-verified --exclude-detectors=Lob: clean
- pytest tests/test_catalog_resolve.py tests/test_cli.py: 35 passed

* fix(ci): exclude test fixtures from trufflehog via .trufflehogignore

REPOSITORY_TRUFFLEHOG_ARGS is not honored by the MegaLinter trufflehog
descriptor; the supported mechanism is a workspace .trufflehogignore
file, which MegaLinter merges into the generated --exclude-paths file.
Excludes packages/create-awesome-python-app/tests/ only — production
code remains fully scanned.

---------

Co-authored-by: ulises-jeremias <ulises-jeremias@users.noreply.github.com>

Author: ulises-jeremias

.trufflehogignore

@@ -0,0 +1,4 @@
+# Lob detector false-positives: any `test_*` function name looks like a Lob
+# test key (shared `test_` prefix). Exclude test fixtures from the scan;
+# production code stays fully covered.
+packages/create-awesome-python-app/tests/.*

Dockerfile

@@ -29,7 +29,7 @@ RUN useradd --create-home --uid 1000 --shell /bin/bash app \
         sleep 15; \
     done
 
-USER app
+USER 1000
 WORKDIR /home/app
 
 ENTRYPOINT ["create-awesome-python-app"]