secret-scanner: sweep leftover dead `trufflehog:` job from consumer workflows (post-#500 remainder)

[hyperpolymath]

What

A number of consumer repos still carry a leftover inline trufflehog: job in
.github/workflows/secret-scanner.yml, left from before TruffleHog was retired as
redundant to the pinned gitleaks reusable. The job runs trufflesecurity/trufflehog@main
with extra_args: --only-verified --fail. @main now injects --fail itself, so the
job dies at argument parsing (flag 'fail' cannot be repeated) before scanning
anything — it provides zero coverage and shows red. Same class as the parse-dead sweep:
a check that can only fail for a spurious reason.

Canonical rsr-template-repo/.github/workflows/secret-scanner.yml deliberately retired
the inline TruffleHog job as redundant — the pinned standards reusable runs gitleaks
(real gate post-#500) + a Rust-secrets check. Fix = sync each consumer to canon:
delete the leftover trufflehog: job, leaving the working scan: (gitleaks reusable)
job untouched.

Status / provenance

Partially swept during the 2026-07 CI campaign: 22 repos fixed while they had an open
fix/ci-timeout-minutes-reusable PR to stack onto (proven green end-to-end on
ochrance-framework, feedback-o-tron, hyperpolymath). That campaign is now merged, so
the remainder — repos that had no open PR at sweep time — still carry the dead job on
main and now need fresh PRs.

Detection (re-derive; do not trust a stale count)

Per repo:

grep -nE '^\s*trufflehog:\s*$' .github/workflows/secret-scanner.yml

Estate: run llm-coding-configs/claude-code/ci-watcher/ci-watch.sh and cross-reference the
Secret Scanner red list. (2026-07-18 snapshot: ~25–28 repos remained, e.g.
accessibility-everywhere still had trufflehog@main. Re-verify — some Secret Scanner
reds have a different cause: boj-server / bunsenite have no trufflehog line yet are red.)

Proven fix (mechanical, one file)

Delete the trufflehog: job block (the awk in the campaign's tf-sweep.sh), then per repo:

• actionlint clean on the file
• 0 remaining trufflehog references
• the secret-scanner-reusable.yml@<sha> call still present
• only secret-scanner.yml changed

Token lacks workflow scope → push .github/workflows/* via SSH
(git@github.com:hyperpolymath/<repo>.git); open draft PRs; never push to main.

Acceptance

• Prove-on-one green before sweeping the rest.
• Every consumer secret-scanner.yml with a leftover trufflehog: job has it removed
  (verified: ci-watch.sh Secret Scanner list no longer shows the arg-parse cause).

Refs: #504 (gitleaks allowlist / re-pin), #505 (governance-reusable's own redundant
trufflehog), #426 (master cause), PR #500 (gitleaks real gate).

Provenance: session aa0b2861, estate CI/CD cleanup campaign, 2026-07-17→20.

[hyperpolymath]

The canon-side templates are fixed in #521: the dead trufflehog: job (dies at arg-parse under @main, zero coverage) is removed from all 6 nested product secret-scanner.yml copies in-tree (0-ai-gatekeeper-protocol, a2ml, consent-aware-http, lol, meta-a2ml, rhodium-standard-repositories — all estate-owned, none under satellites/). The reusable itself was already clean (comment-only mentions).

Estate execution scope, measured 2026-07-21 (gh code search, default branches) — left for the estate sweep, not done here: only 3 live repos still carry the dead job — ideas-to-alphas (startup_failure), polystack (failure), QuantumCircuit.jl (failure). 17 more matched the canonical rationale comment only (no job, no action). julia-ecosystem has ~10 inert nested per-package copies (plus .gitlab-ci.yml twins that would be live if GitLab-mirrored); rsr-template-how-to's copies are deliberate teaching specimens under specimen/automation-quarantine/. So the real fix set is those 3 repos + the julia-ecosystem package copies.