ci(secret-scan): canonical estate scanner caller, key scan (D243) (#16)

## What

Write the canonical estate secret-scanner caller to
`.github/workflows/secret-scanner.yml` so this repo emits `scan /
gitleaks`, the context the estate Secret-Scan-Floor ruleset (D243/D244)
requires. This repo had no secret-scanner caller.

Job key `scan`; reusable
`hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2`;
push trigger on `main`. actionlint clean (previous file findings: n/a).
Commit via GraphQL `createCommitOnBranch` (GitHub-signed, valid: true).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/secret-scanner.yml

@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: MPL-2.0
+# Prevention workflow - scans for hardcoded secrets before they reach main.
+#
+# Calls the estate's shared secret scanner (gitleaks + rust-secrets +
+# shell-secrets). The job key MUST stay `scan`: the estate-wide
+# Secret-Scan-Floor ruleset requires the check context `scan / gitleaks`.
+#
+# No `secrets:` line, deliberately: the reusable references no secrets
+# (gitleaks runs as a checksum-verified binary, not gitleaks-action), so
+# `secrets: inherit` would only hand it every repo and org secret (CWE-250).
+name: Secret Scanner
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2