fix(secret-scanner): pin gen-1 baseline fetch to job.workflow_sha

.github/workflows/secret-scanner-reusable.yml

@@ -158,15 +158,38 @@ jobs:
       # and inherit the whole baseline while adding only its own exemptions, so
       # a repo-specific blind spot stays local to the repo that justified it
       # instead of widening the allowlist for all 400+.
+      #
+      # THIS STEP IS UNGATED ON PURPOSE. It is the only thing that creates
+      # `.gitleaks-estate.toml` for a consumer with no `.gitleaks.toml` of its
+      # own — the large majority — and that is exactly the consumer whose
+      # CONFIG resolves to that file in the scan step below. Do not delete it
+      # as a duplicate of the gated "Estate baseline — is it referenced?"
+      # block further down; that block fires only for repos that DO have a
+      # local config, so removing this one leaves CONFIG naming a file nothing
+      # creates, across most of the estate.
+      #
+      # `ref` was `main` until 2026-09-04, and that was worse than a moving
+      # pin: the file this step fetches has been RENAMED under it. Before
+      # 86bad549 the shared allowlist WAS `.gitleaks.toml` (148 lines, 16
+      # rules) and gen-1 sparse-checked-out that path; after the rename,
+      # `.gitleaks.toml` is standards' own 18-line dogfooding stub whose
+      # `[extend] path` points at `config/gitleaks/estate-baseline.toml` — a
+      # path the consumer does NOT have, because this step stages exactly one
+      # file. So every consumer pinned before the rename silently began
+      # staging a stub with a dangling `[extend]`. `job.workflow_sha` is the
+      # commit of THIS reusable, so a consumer now receives the baseline as it
+      # stood at the SHA it pins, and the path each SHA references exists at
+      # that SHA (verified for all six gen-1 SHAs, 2026-09-04).
       - name: Fetch estate gitleaks baseline
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: hyperpolymath/standards
-          ref: main
+          ref: ${{ job.workflow_sha }}
           path: .standards-gitleaks
           sparse-checkout: |
             config/gitleaks/estate-baseline.toml
           sparse-checkout-cone-mode: false
+          persist-credentials: false
 
       - name: Stage estate gitleaks baseline
         run: |