ci(secret-scan): canonical estate scanner caller, key scan (D243)

[hyperpolymath]

What

Write the canonical estate secret-scanner caller to .github/workflows/secret-scanner.yml so this repo emits scan / gitleaks, the context the estate Secret-Scan-Floor ruleset (D243/D244) requires. The previous inline scanner jobs emitted bare contexts (e.g. gitleaks) that cannot satisfy the floor; the reusable deliberately drops TruffleHog as redundant with gitleaks.

Job key scan; reusable hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2; push trigger on main. actionlint clean (previous file findings: 0). Commit via GraphQL createCommitOnBranch (GitHub-signed, valid: true).

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

Deferred red checks

• Deferred: PR (address) → CI: 6 red check(s) on the default branch, deferred from #102 #103
• Deferred: governance / Actions lockfile verify → CI: 6 red check(s) on the default branch, deferred from #102 #103
• Deferred: governance / Guix packaging policy (Nix retired) → CI: 6 red check(s) on the default branch, deferred from #102 #103
• Deferred: hypatia / Hypatia Neurosymbolic Analysis → CI: 6 red check(s) on the default branch, deferred from #102 #103
• Deferred: rust-ci / Cargo audit (security) → CI: 6 red check(s) on the default branch, deferred from #102 #103
• Deferred: rust-ci / Cargo check + clippy + fmt → CI: 6 red check(s) on the default branch, deferred from #102 #103

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 31 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 86b4eef5-be4e-4481-a7d2-738b062d3004

📥 Commits

Reviewing files that changed from the base of the PR and between 83f272f and 21abfc9.

📒 Files selected for processing (1)

• .github/workflows/secret-scanner.yml

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}