fix(ci): bump secret-scanner SHA pin + scanner-allow pragma on test fixture

[hyperpolymath]

Summary

• Bumps secret-scanner-reusable.yml pin from 3e4bd4c → 28fdf19 (standards#236).
• Adds # scanner-allow: shell-secrets pragma above export ARANGODB_PASSWORD="testpassword" in integration/run-tests.sh.
• hooks/lib/cache.sh line 22 (CICD_CACHE_PASSWORD="${CICD_CACHE_PASSWORD:-}") now passes automatically via the new param-expansion exemption — no code change needed there.

What changed in standards#236

The shell-secrets scanner job in the reusable gained four exemption layers:

1. Inline pragma (# scanner-allow: shell-secrets or # hypatia: allow security_errors/secret_detected) on same or preceding line.
2. .shell-secrets-ignore file support (gitignore-style path globs).
3. Automatic param-expansion skip (${VAR:-}, ${VAR:?}, $VAR — not literals).
4. Comment-line skip (lines starting with # cannot hold real secrets).

Test plan

• Local smoke: all three false-positive lines skip cleanly with the new scanner logic.
• CI green on this PR (shell-secrets job should now pass on main).

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 102 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	102

View findings

[
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in clusterfuzzlite.yml",
    "type": "unknown",
    "file": "clusterfuzzlite.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in clusterfuzzlite.yml",
    "type": "unknown",
    "file": "clusterfuzzlite.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence