governance-reusable: two jobs cannot fail (Code quality + docs; Guix/Nix policy) + redundant trufflehog

[hyperpolymath]

governance-reusable.yml — two jobs cannot fail, plus a redundant scanner

Surfaced by the nexia-list CI failure-path audit (2026-07-17). governance-reusable.yml is partly real — most of its jobs have genuine exit 1 paths (Check Workflow Staleness, Language/package anti-pattern, Security policy checks, Well-Known RFC 9116, Workflow security linter, Trusted-base, Licence consistency). These are fine and should be kept. But two jobs are theatre:

1. "Code quality + docs" — no path to non-zero

• trufflehog step: continue-on-error: true
• editorconfig step: continue-on-error: true
• everything else: ... | head -10 || true, || echo, ::warning::

Nothing in this job can make the check red. It reports success over any input.

2. "Guix primary / Nix fallback policy" — echo-only

Every branch echoes; the job terminates with echo "✅ Package policy check passed" and no exit 1. It cannot detect a policy violation.

3. Redundant secret scanner

This reusable's trufflehog overlaps secret-scanner-reusable (which, post-#500, is the real gitleaks gate). The secret-scanner reusable's own header even claims "Trufflehog removed as redundant" while governance still runs it — a self-contradiction across the same estate.

Task

• Make "Code quality + docs" gate: pick the checks that are genuinely required (e.g. editorconfig conformance) and let them fail; downgrade the rest to explicitly-advisory with a comment saying so, or drop them.
• Make "Guix/Nix policy" gate on a real violation, or delete it if the policy is not actually enforceable yet (don't keep a green stub — per doctrine, an unrunnable gate that reports success manufactures confidence).
• Remove the redundant trufflehog step now that gitleaks gates for real; reconcile the "Trufflehog removed as redundant" header claim.
• Prove each change with both a pass and a fail fixture before merge.

Note: reusable changes are not self-tested in standards (callers pin a fixed SHA), so validate locally / in a consumer branch, not just by watching standards CI go green.

Refs: PR #500 (gitleaks real gate). Companion: the .gitleaks.toml allowlist follow-up.