ci(deps): bump trufflehog to 3.95.6

[steipete]

Summary

• update the TruffleHog secret-scan action from 3.95.5 to 3.95.6
• pick up scanner correctness fixes, including long-line coverage and fewer false verified findings

Verification

• actionlint
• GOWORK=off go test -count=1 ./...
• repo-local Codex autoreview: clean
• runtime code unchanged; the PR secret-scan job is the end-to-end workflow proof

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: ci(deps): bump trufflehog to 3.95.6 This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[steipete]

Landed as 5a64429fb61e5ee3a773ce724311e51e77729058.

Verification:

• actionlint passed
• GOWORK=off go test -count=1 ./... passed
• repo-local Codex autoreview returned no actionable findings
• exact head 26a10b3d4b0d7b1eb8f91c535ef848e1926e1408: the updated TruffleHog 3.95.6 workflow passed, together with CI, CodeQL, Docker, dependency validation, release snapshot, and the second secret scan: https://github.com/openclaw/discrawl/actions/runs/27820864407
• runtime code unchanged; no archive/provider live boundary applied

Caveats: none.