ci: adopt the shared scan baseline

[altaywtf]

Problem

This repo carries its own scan workflow copies; every scanner version or digest bump costs a commit here.

Solution

Replace them with the thin caller for uinaf/.github's shared scan (gitleaks, trufflehog, actionlint, zizmor) plus the scoped zizmor policy, and satisfy the baseline where it found real drift. Local zizmor . reports no findings. Scan-copy conversion follow-up from ffsstack#53.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adopts uinaf/.github’s shared scan baseline (gitleaks, trufflehog, actionlint, zizmor) by replacing local scanner workflows with a thin reusable-workflow caller, and adds a scoped zizmor policy to allow first-party reusable workflows to track main.

Changes:

• Add a thin .github/workflows/scan.yml caller workflow that runs the shared scan baseline.
• Replace secrets jobs in main.yml and release.yml with the shared scan baseline job.
• Add .github/zizmor.yml policy and remove local secrets.yml + actions-lint.yml workflows.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/zizmor.yml	Adds zizmor policy exceptions for first-party reusable workflows.
.github/workflows/secrets.yml	Removes repo-local secret scanning workflow (now covered by shared scan).
.github/workflows/scan.yml	Adds a thin caller workflow to run the shared scan baseline.
.github/workflows/release.yml	Switches from local secrets workflow to shared scan and updates job dependencies.
.github/workflows/main.yml	Switches from local secrets workflow to shared scan and updates job dependencies.
.github/workflows/actions-lint.yml	Removes repo-local workflow linting (now covered by shared scan).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[slopzapper]

✨ CLEAN

The callers match the shared scan contract: workflow_call, contents:read, and the same four scanners the deleted workflows ran. The zizmor ref-pin exception matches owner/repo/* for uinaf/.github reusable workflows.