fix(ci): call the secret scanner from proven-cicd-and-workflows

.github/workflows/secret-scanner.yml

@@ -1,27 +1,41 @@
 # SPDX-License-Identifier: MPL-2.0
-# Calls the estate's shared secret scanner (gitleaks + rust-secrets +
-# shell-secrets).
+# This workflow is managed by gh actions-lock.
+name: Secret Scanner
+
+# Calls the published cicd-suite scanner, as gitbot-fleet does. The context
+# this repository's ruleset requires, scan / gitleaks, is produced by the
+# callee's gitleaks job (its supplemental matrix also reports
+# scan / rust-secrets and scan / shell-secrets).
+#
+# The previous caller called metadatastician/standards, which this
+# repository's Actions settings do not allow, so every run failed at
+# startup with zero jobs.
 #
-# No `secrets:` line: the reusable workflow declares no secrets and reads
-# none, and `secrets: inherit` would forward every secret this repository
-# can see (CWE-250; standards#1108 §6b, in the workflow's own header).
-name: "Secret Scanner"
+# Boundaries:
+#   * `fast-pr` stays false: every run scans full history.
+#   * No `secrets:` line. The callee declares no workflow_call secret and
+#     installs its own checksum-pinned binary, so `secrets: inherit` would
+#     forward every repository and organisation secret for no benefit.
+#   * `contents: read` is the whole grant the callee's jobs declare.
+
 on:
+  pull_request:
   push:
     branches: [main]
-  pull_request:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 permissions:
-  actions: read
   contents: read
 
 jobs:
   scan:
-    # The same standards commit as scorecard.yml. gh-actions-lock v0.4.1
-    # does not lock external reusable calls; keep this full SHA pin.
-    # The repository moved owners; retain the already-reviewed commit.
-    uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
+    # This job-level block REPLACES the workflow-level one. Granting less than
+    # the callee's jobs declare rejects the run at startup with zero jobs.
+    permissions:
+      contents: read
+    uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6
+    with:
+      fast-pr: false