Sync secret-scanner.yml to canon — remove redundant inline trufflehog job

[hyperpolymath]

Sync secret-scanner.yml to canon — remove the now-redundant inline trufflehog: job

.github/workflows/secret-scanner.yml runs the canonical scan: job (the secret-scanner-reusable.yml@d135b05 bundle: gitleaks + rust-secrets + shell-secrets) plus a second inline trufflehog: job (lines 20-36).

This is not a red — the trufflehog job here is already correctly configured (SHA-pinned @27b0417 # v3.95.9, base: "", extra_args: --only-verified, no double --fail) and Secret Scanner is green on main. This is a tidy-to-canon, not a fix.

Why remove it: the standards reusable deliberately retired trufflehog as redundant — gitleaks gives sufficient coverage at lower cost, and trufflehog --only-verified actually missed the real Cloudflare token leak that the shell-secrets job was created to catch (see standards/.github/workflows/secret-scanner-reusable.yml header, lines 10-36). The canonical rsr-template-repo/.github/workflows/secret-scanner.yml carries only the scan: job. Keeping the inline trufflehog is duplicated work, not extra coverage.

Fix: delete the trufflehog: job so this file matches canon (scan: job only). Keep the top-of-file comment explaining the deliberate retirement (adapt from rsr-template-repo, but omit its README.adoc reference — that file does not exist in this repo).

Pre-flight already verified:

• Neither ruleset (default-branch-protection id 18111148, immutable-tags id 18111149) has any required_checks → removing the job breaks no required status check.
• origin is SSH (git@github.com:...) → workflow-scope push works.

Verification gate: actionlint parse is necessary but NOT sufficient — watch the real Secret Scanner check go green on the PR before merge.