ci(secret-scan): call the scanner in proven-cicd-and-workflows

.github/workflows/README.adoc

@@ -18,10 +18,10 @@ either loses real function — keep both.
 
 == Secret scanning is single-sourced
 
-`secret-scanner.yml` calls the standards reusable (gitleaks + a Rust-secrets
-check). An inline TruffleHog job was removed: the reusable deliberately retired
-TruffleHog as redundant with gitleaks, so re-adding it was duplicated work, not
-extra coverage.
+`secret-scanner.yml` calls the reusable scanner of
+`hyperpolymath/proven-cicd-and-workflows` at a pinned commit (gitleaks, a
+Rust-secrets check and a shell-secrets check). An inline TruffleHog job was
+removed earlier as redundant with gitleaks; do not add it again.
 
 == SAST tools are complementary, not redundant
 

.github/workflows/secret-scanner.yml

@@ -1,4 +1,18 @@
 # SPDX-License-Identifier: MPL-2.0
+# Caller of the estate secret scanner in hyperpolymath/proven-cicd-and-workflows,
+# at the commit that echidnabot and gitbot-fleet call. The called workflow runs
+# gitleaks, a Rust-secrets check and a shell-secrets check.
+#
+# The earlier caller named the standards repository. It did not start: each
+# run ended at creation, with no job and no check.
+#
+# Boundaries, as in the gitbot-fleet caller:
+#   * The job id is `scan`. The called workflow reads this file and refuses a
+#     caller that has a different job id or a pin that is not a full SHA.
+#   * `fast-pr` is false: each run scans the full history.
+#   * No `secrets:` line. The called workflow declares no workflow_call secret.
+#   * `contents: read` is the whole grant.
+# See .github/workflows/README.adoc.
 name: Secret Scanner
 on:
   pull_request:
@@ -9,17 +23,10 @@ concurrency:
   cancel-in-progress: true
 permissions:
   contents: read
-# Single secret scanner. The standards reusable runs gitleaks (+ a Rust-secrets
-# check). An inline TruffleHog job previously lived here, but the reusable
-# DELIBERATELY retired TruffleHog as redundant (gitleaks gives sufficient
-# coverage at lower cost — see the reusable's header). Re-adding it was
-# duplicated work, not extra coverage, so it has been removed. See
-# .github/workflows/README.adoc.
 jobs:
   scan:
     permissions:
-      actions: read
-      security-events: write
       contents: read
-    # No `secrets:` line. The called workflow uses only the automatic token.
-    uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a
+    uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6
+    with:
+      fast-pr: false