ci(secret-scan): canonical estate scanner caller, key scan (D243) (#102)

## What

Write the canonical estate secret-scanner caller to
`.github/workflows/secret-scanner.yml` so this repo emits `scan /
gitleaks`, the context the estate Secret-Scan-Floor ruleset (D243/D244)
requires. The previous inline scanner jobs emitted bare contexts (e.g.
`gitleaks`) that cannot satisfy the floor; the reusable deliberately
drops TruffleHog as redundant with gitleaks.

Job key `scan`; reusable
`hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2`;
push trigger on `main`. actionlint clean (previous file findings: 0).
Commit via GraphQL `createCommitOnBranch` (GitHub-signed, valid: true).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

## Deferred red checks

- Deferred: `PR (address)` → #103
- Deferred: `governance / Actions lockfile verify` → #103
- Deferred: `governance / Guix packaging policy (Nix retired)` → #103
- Deferred: `hypatia / Hypatia Neurosymbolic Analysis` → #103
- Deferred: `rust-ci / Cargo audit (security)` → #103
- Deferred: `rust-ci / Cargo check + clippy + fmt` → #103

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -1,82 +1,27 @@
 # SPDX-License-Identifier: MPL-2.0
-# Prevention workflow - scans for hardcoded secrets before they reach main
+# Prevention workflow - scans for hardcoded secrets before they reach main.
+#
+# Calls the estate's shared secret scanner (gitleaks + rust-secrets +
+# shell-secrets). The job key MUST stay `scan`: the estate-wide
+# Secret-Scan-Floor ruleset requires the check context `scan / gitleaks`.
+#
+# No `secrets:` line, deliberately: the reusable references no secrets
+# (gitleaks runs as a checksum-verified binary, not gitleaks-action), so
+# `secrets: inherit` would only hand it every repo and org secret (CWE-250).
 name: Secret Scanner
 
 on:
   pull_request:
   push:
     branches: [main]
 
-# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
-# updates do not pile up queued runs against the shared account-wide
-# Actions concurrency pool. Applied only to read-only check workflows
-# (no publish/mutation), so cancelling a superseded run is always safe.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 permissions:
-  actions: read
   contents: read
 
 jobs:
-  trufflehog:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
-        with:
-          fetch-depth: 0  # Full history for scanning
-
-      - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@4dd8831c5f12599465d4d45c3c447b4018a34c85 # v3
-        with:
-          # The v3 action injects --fail automatically on pull_request events.
-          # Passing --fail here triggers "flag 'fail' cannot be repeated".
-          extra_args: --only-verified
-
-  gitleaks:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
-        with:
-          fetch-depth: 0
-
-      - name: Gitleaks Secret Scan
-        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  # Rust-specific: Check for hardcoded crypto values
-  rust-secrets:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
-
-      - name: Check for hardcoded secrets in Rust
-        run: |
-          if ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then
-            echo 'No Cargo.toml found — skipping Rust secrets check'
-            exit 0
-          fi
-          # Patterns that suggest hardcoded secrets
-          PATTERNS=(
-            'const.*SECRET.*=.*"'
-            'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
-            'const.*TOKEN.*=.*"'
-            'let.*api_key.*=.*"'
-            'HMAC.*"[a-fA-F0-9]{32,}"'
-            'password.*=.*"[^"]+"'
-          )
-
-          found=0
-          for pattern in "${PATTERNS[@]}"; do
-            if grep -rn --include="*.rs" -E "$pattern" src/; then
-              echo "WARNING: Potential hardcoded secret found matching: $pattern"
-              found=1
-            fi
-          done
-
-          if [ $found -eq 1 ]; then
-            echo "::error::Potential hardcoded secrets detected. Use environment variables instead."
-            exit 1
-          fi
+  scan:
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2