v0.6.0 — Secret scan: renamed job, shallow checkout

Two secret-scan changes. No new scans, inputs, or hooks.

Action required if you gate on the secret-scan check. The Pulse secret-scan job is renamed pulse → pulse-secret, matching pulse-oss and pulse-malware. Its status check becomes … / pulse-secret. If a branch-protection rule requires the old … / pulse check, update that rule in the same change that repins — otherwise the rule blocks on a check that will never report.

Faster scans. The filesystem scan now checks out at depth 1. filesystem mode reads the checked-out tree, not packed Git history, so fetching every branch and tag bought no scan coverage. In NVIDIA/cuda-python that fetch was ~317s of a ~404s job: 3.54 GB downloaded, most of it the unrelated gh-pages branch, to scan 33 MB of source.

Inputs, permissions, failure_policy behaviour, and every pre-commit hook are unchanged.

Full notes: CHANGELOG.md