Trufflehog binary should be shipped and ran from `/static` to allow for updates

We currently install Trufflehog CLI in the Github Workflow after downloading it from their releases. To cater for environments where it is not possible to download (or automatically update it with `--no-update` flag removed), we should instead ship and use the appropriate binary from our `/static` folder, like we do for `uv` and `mc`.

Start by inspecting the GitHub Workflow that downloads Trufflehog and the `/static` entries for `uv` and `mc`. Identify the appropriate Trufflehog binary and update the workflow to invoke the shipped copy; done means it works in environments without downloads and preserves the intended no-update behavior.

Written by the indexing model from the issue text.