secret-scanner.yml: trufflehog 3.95.x emits duplicate --fail; remove from extra_args

[hyperpolymath]

Problem

In hyperpolymath/volumod, the Secret Scanner workflow fails when bumped to trufflesecurity/trufflehog@v3.95.3:

trufflehog: error: flag 'fail' cannot be repeated, try --help
##[error]Process completed with exit code 1.

secret-scanner.yml passes extra_args: --only-verified --fail. In trufflehog action v3.95.x the entrypoint now appends its own --fail, producing duplicate flags. Upstream's CLI is strict and rejects.

(Older pins of the same action ignored the duplicate; the regression appears between the previous pinned version and 3.95.3.)

Impact

• build(deps): bump trufflesecurity/trufflehog from 3.93.3 to 3.95.3 volumod#16 (build(deps): bump trufflehog 3.93.3 → 3.95.3) cannot merge.
• Same template lives in hyperpolymath/standards and likely propagates to other repos that already have the newer pin.

Fix

Remove --fail from extra_args in .github/workflows/secret-scanner.yml:

- name: TruffleHog Secret Scan
  uses: trufflesecurity/trufflehog@<sha> # v3
  with:
    extra_args: --only-verified

The action emits a non-zero exit on verified findings on its own (in 3.95+); we don't need to pass --fail.

Apply the same fix in hyperpolymath/standards/.github/workflows/secret-scanner.yml (template source) so other repos pick it up on next sync.

[hyperpolymath]

Verified resolved on standards/main: extra_args is now --only-verified only — duplicate --fail is removed. Comments explain the v3 action injects --fail automatically on pull_request. Closing.