Install TruffleHog in the pre-commit hook environment

[kkraus14]

What changed

• Replaced the Bash hooks/trufflehog.sh launcher and its per-user cache with a language: python secret-scan-trufflehog hook that invokes trufflehog filesystem --results=verified --fail --no-update directly. The public hook ID and default scan options remain unchanged.
• Added a minimal, generic root Python package bridge required by pre-commit for Python-language hook repositories. Tool-specific dependencies remain isolated to each hook.
• Added hooks/trufflehog, which uses supported setup.cfg configuration and setuptools-download==1.1.0 to select, SHA-256-verify, and install the matching official TruffleHog v3.95.9 archive for Linux, macOS, and Windows on x86_64 and ARM64. setup.py only marks the locally built wheel as platform-specific.
• Uses setuptools>=70.1 without an upper ceiling. A fresh warning-fatal hook installation resolves the released setuptools-download wheel cleanly, so no warning suppression is needed.
• Replaced the TruffleHog-specific smoke invocation with pre-commit try-repo . --all-files. This is the repository's manifest-driven dogfood path: it discovers and runs the published default-stage hooks from the current checkout on all six supported OS/architecture pairs.
• Updated the repository config comment, contributor guidance, documentation, notices, ignored build artifacts, changelog, and Actionlint pin. No TruffleHog archive or binary is checked in or published by this repository.

Why

This moves binary lifecycle management into pre-commit's isolated environment and removes the developer-side Bash/Git Bash/MSYS, curl/wget, tar, SHA utility, system TruffleHog, and external cache requirements. The downloaded executable is owned by the hook environment and is removed by pre-commit clean.

Review focus

• Verify the six official archive URL/SHA-256 pins and explicit runner-to-marker mappings.
• Confirm the unchanged hook ID and default scan options preserve the public contract.
• Confirm the generic root bridge and hook-specific dependency are the intended pre-commit installation boundary.
• Confirm the generic try-repo smoke covers the current manifest and treats Python warnings as errors.

Validation

• pre-commit validate-config .pre-commit-config.yaml
• pre-commit validate-manifest .pre-commit-hooks.yaml
• Fresh PIP_NO_CACHE_DIR=1 PYTHONWARNINGS=error PRE_COMMIT_HOME=<temporary directory> pre-commit try-repo . --all-files
• Fresh PIP_NO_CACHE_DIR=1 PRE_COMMIT_HOME=<temporary directory> pre-commit run --all-files --show-diff-on-failure
• git diff --check

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[kkraus14]

/ok to test ffdb38b