reusable-trufflehog: "Remove persisted credentials" fails with exit 5 under actions/checkout v6+, silently skipping the scan

## Summary

In `.github/workflows/reusable-trufflehog.yml`, the `Remove persisted credentials` step fails on every run, which aborts the job before TruffleHog is installed. The scan step never executes, so repos using this workflow get a red check with no scan output and no findings, rather than actual secret scanning.

Because the org wrapper sets `fail-on-verified: false` / `fail-on-unverified: false`, the intent is a non-blocking check. The effect is a permanently failing non-required check that people learn to ignore, with no scan coverage behind it.

## Cause

Step:

```yaml
- name: Remove persisted credentials
run: git config --unset-all http.https://github.com/.extraheader
```

This assumes `actions/checkout` persists credentials as a local `http.https://github.com/.extraheader` entry. Since [checkout v6.0.0](https://github.com/actions/checkout/compare/v5.0.0...v6.0.0) ([#2286](https://github.com/actions/checkout/pull/2286)) that is no longer true: credentials are written to a separate file under `$RUNNER_TEMP` and linked via `includeIf.gitdir` directives instead.

The workflow currently pins `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1`, so the `extraheader` key is absent from the local config. `git config --unset-all` on a nonexistent option exits **5**, the step runs under `bash -e`, and the job fails roughly 8ms in.

Downstream steps are then skipped:

| # | Step | Result |
|---|---|---|
| 6 | Remove persisted credentials | failure |
| 7 | Fetch org-wide TruffleHog exclude patterns | skipped |
| 8 | Install TruffleHog | skipped |
| 9 | Scan for secrets | skipped |

The post-job cleanup log confirms the new layout, showing `actions/checkout` unsetting `includeif.gitdir:.../.git.path` and `includeif.gitdir:.../.git/worktrees/*.path` entries pointing at a `git-credentials-*.config` file.

## Reproduction

Reproduced on three consecutive PRs in a private Grafana repo consuming the org-required wrapper, on `ubuntu-arm64-small`, with TruffleHog `v3.95.9`. Re-running the failed job reproduces it. I can share job links internally.

Nothing repo-specific is involved, so any repo using this workflow at its current checkout pin should be affected.

## Suggested fix

Make the cleanup tolerant of a missing key, since that is now the normal case:

```yaml
- name: Remove persisted credentials
run: git config --unset-all http.https://github.com/.extraheader || true
```

Or gate it on presence with `git config --get` first. Note this only silences the error; with checkout v6+ the credentials live in the separate `includeIf` file, so if the goal is actively removing them before scanning rather than defense in depth on top of checkout's own post-job cleanup, that needs revisiting too. `persist-credentials: false` on the checkout step may be the better fit, given the job only fetches base and head SHAs.

Separately, it may be worth reconsidering whether a failure in a credential-cleanup step should be able to skip the scan silently. A guard that fails loudly when the scan step is skipped would have surfaced this much sooner.

I have not tested the fix, so treat the above as a suggestion rather than a verified patch.

Start in .github/workflows/reusable-trufflehog.yml by reading the checkout and Remove persisted credentials steps, then inspect how the current cleanup command behaves when the configuration key is absent. Verify that cleanup no longer aborts the job and that the exclude-pattern, installation, and scan steps run; consider the issue’s note about persist-credentials as a separate decision.

Written by the indexing model from the issue text.