secret-scanner: sweep leftover dead trufflehog: job from consumer workflows (post-#500 remainder) #507

What

A number of consumer repos still carry a leftover inline trufflehog: job in
.github/workflows/secret-scanner.yml, left from before TruffleHog was retired as
redundant to the pinned gitleaks reusable. The job runs trufflesecurity/trufflehog@main
with extra_args: --only-verified --fail. @main now injects --fail itself, so the
job dies at argument parsing (flag 'fail' cannot be repeated) before scanning
anything — it provides zero coverage and shows red. Same class as the parse-dead sweep:
a check that can only fail for a spurious reason.

Canonical rsr-template-repo/.github/workflows/secret-scanner.yml deliberately retired
the inline TruffleHog job as redundant — the pinned standards reusable runs gitleaks
(real gate post-#500) + a Rust-secrets check. Fix = sync each consumer to canon:
delete the leftover trufflehog: job, leaving the working scan: (gitleaks reusable)
job untouched.

Status / provenance

Partially swept during the 2026-07 CI campaign: 22 repos fixed while they had an open
fix/ci-timeout-minutes-reusable PR to stack onto (proven green end-to-end on
ochrance-framework, feedback-o-tron, hyperpolymath). That campaign is now merged, so
the remainder — repos that had no open PR at sweep time — still carry the dead job on
main and now need fresh PRs.

Detection (re-derive; do not trust a stale count)

Per repo:

grep -nE '^\s*trufflehog:\s*$' .github/workflows/secret-scanner.yml

Estate: run llm-coding-configs/claude-code/ci-watcher/ci-watch.sh and cross-reference the
Secret Scanner red list. (2026-07-18 snapshot: ~25–28 repos remained, e.g.
accessibility-everywhere still had trufflehog@main. Re-verify — some Secret Scanner
reds have a different cause: boj-server / bunsenite have no trufflehog line yet are red.)

Proven fix (mechanical, one file)

Delete the trufflehog: job block (the awk in the campaign's tf-sweep.sh), then per repo:

• actionlint clean on the file
• 0 remaining trufflehog references
• the secret-scanner-reusable.yml@<sha> call still present
• only secret-scanner.yml changed

Token lacks workflow scope → push .github/workflows/* via SSH
(git@github.com:hyperpolymath/<repo>.git); open draft PRs; never push to main.

Acceptance

• Prove-on-one green before sweeping the rest.
• Every consumer secret-scanner.yml with a leftover trufflehog: job has it removed
  (verified: ci-watch.sh Secret Scanner list no longer shows the arg-parse cause).

Refs: #504 (gitleaks allowlist / re-pin), #505 (governance-reusable's own redundant
trufflehog), #426 (master cause), PR #500 (gitleaks real gate).

Provenance: session aa0b2861, estate CI/CD cleanup campaign, 2026-07-17→20.