fix(ci): green the Registry+topology check — regen registry drift + de-TruffleHog a2ml/S4 scorecard (#525 fallout) (#531)

Greens the required **`Registry + topology in sync`** check, which has
been red on main and blocking every PR. That job had **two** failures —
the first masking the second:

**1. Registry drift (step 4).** `build-registry.sh --check` reported
`REGISTRY.a2ml is stale`. Regenerated from a clean clone of `main`: only
7 `source_hash` values updated to match the tree, no entries
added/removed, `TOPOLOGY.md` unchanged. This is the recurrence #381's
pre-commit guard is meant to prevent (it reached main without the hook).

**2. Stale scorecard `a2ml/S4` (step 6, previously masked).** Once the
registry step passes, `build-scorecards.sh --verify` runs and fails:
`a2ml/S4: claimed PASS but check exited 1`. The check still required
`trufflesecurity/trufflehog` in
`a2ml/.github/workflows/secret-scanner.yml`, but **#525 deliberately
removed TruffleHog estate-wide**. Updated S4's
`check`/`evidence`/`system` to the post-#525 reality (gitleaks +
rust/shell secret jobs).

Verified locally: `build-registry.sh --check` passes, the new S4 check
holds (gitleaks present), dashboard is current. (`--verify`'s full run
needs ripgrep/xmllint/jq — the env-preflight guard correctly declines to
judge without them; CI has them.)

Follow-up (#381 option 2): a CI job that auto-regenerates + commits the
registry on drift would stop this reaching main again.

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/REGISTRY.a2ml

@@ -45,7 +45,7 @@ name = "A2ML — Attested Markup Language"
 stream = "foundation"
 home = "a2ml/"
 canonical_doc = "a2ml/README.adoc"
-source_hash = "sha256:11ffe50a8a15e22d800383589a947ca76a56d96d4f43f673b2d820ef64000436"
+source_hash = "sha256:215dd1cc7dd184922d6cb04957cd17dfccb7f00ea78252ff5a53634d67851980"
 route = "the typed/verified machine-readable document format"
 
 [[spec]]
@@ -54,7 +54,7 @@ name = "K9 Self-Validating Components"
 stream = "foundation"
 home = "k9-svc/"
 canonical_doc = "k9-svc/README.adoc"
-source_hash = "sha256:7b851b1bd94b5561059bff1a21ebff2618d2bb12aa811f1c3329a199cd1fa79b"
+source_hash = "sha256:84313508e94620b1fb70a853d49e9e080d93ff8413475caaaf0eb64db499a69f"
 route = "self-validating components with embedded contracts + deploy logic"
 
 [[spec]]
@@ -63,7 +63,7 @@ name = "Contractiles (Must/Trust/Dust/Intend)"
 stream = "foundation"
 home = "contractiles/"
 canonical_doc = "contractiles/README.adoc"
-source_hash = "sha256:5cd3214144ae7f1385f1ea689ac43cf5edb65bbe69a48015fa32e66725bf66bd"
+source_hash = "sha256:196b51cb7efbe7c9dc775513e45e46d5b88404dd8c0cf50391a466cba3b53a34"
 route = "policy-enforcement primitives the K9 layer is built from"
 
 [[spec]]
@@ -135,7 +135,7 @@ name = "0-AI Gatekeeper Protocol"
 stream = "protocol"
 home = "0-ai-gatekeeper-protocol/"
 canonical_doc = "0-ai-gatekeeper-protocol/README.adoc"
-source_hash = "sha256:00d9193c6bd4409e9c9928133d57a8b5afd93a26797e957fbb6d189707c241f6"
+source_hash = "sha256:a5bb4eaac86202798bd47f7e403c6f95fcf1c95ee517e8930a599983a1dd8c64"
 route = "the AI-agent entry/gating protocol behind 0-AI-MANIFEST"
 
 [[spec]]
@@ -162,7 +162,7 @@ name = "AXEL Protocol"
 stream = "protocol"
 home = "axel-protocol/"
 canonical_doc = "axel-protocol/README.adoc"
-source_hash = "sha256:b9f31b9e5c77f1a26cbb4ee4cb29fcbc64079116c0c6e190f11dc5fbb9329449"
+source_hash = "sha256:326c47a6ca32531d4acff17aaf0313b7579a9d5749429f72f97e907af1fa8d33"
 route = "age-gating + explicit-content enforcement"
 
 [[spec]]
@@ -180,7 +180,7 @@ name = "Consent-Aware HTTP"
 stream = "protocol"
 home = "consent-aware-http/"
 canonical_doc = "consent-aware-http/README.adoc"
-source_hash = "sha256:7cb83ee0414539d8594b93a83ecf67fe5744b9f3d40b1f209946370dab423652"
+source_hash = "sha256:d5cee84e0bccc969cbc76cd17cbf18e6835750a5e664788a4a96f5b50f5fdb2a"
 route = "consent headers / AI-usage boundaries for HTTP"
 
 [[spec]]
@@ -225,7 +225,7 @@ name = "RSR — Rhodium Standard Repositories"
 stream = "governance"
 home = "rhodium-standard-repositories/"
 canonical_doc = "rhodium-standard-repositories/README.adoc"
-source_hash = "sha256:fa0fcde2d5be8ed8e4c7067f2a309a3ce424f6fafc942b7a10981546844a971d"
+source_hash = "sha256:6a00a68f900f3b53441b5809191e0d0098cf255b53ae3e94ee2cc4320517c94e"
 route = "the repository-compliance standard every repo is graded against"
 
 [[spec]]

.machine_readable/scorecards/a2ml.scorecard.a2ml

@@ -81,10 +81,10 @@ effects = "Without scheduled fuzzing, parser crashes on malformed/adversarial in
 [[should]]
 id = "S4"
 text = "Secrets SHOULD be scanned on every push/PR to prevent credential leaks."
-system = ".github/workflows/secret-scanner.yml (TruffleHog + Gitleaks jobs)"
+system = ".github/workflows/secret-scanner.yml (Gitleaks + rust/shell secret jobs)"
 status = "pass"
-evidence = "secret-scanner.yml runs both trufflesecurity/trufflehog (--only-verified --fail) and a gitleaks job on pull_request and push to main."
-check = "test -f a2ml/.github/workflows/secret-scanner.yml && grep -q 'trufflesecurity/trufflehog' a2ml/.github/workflows/secret-scanner.yml && grep -q 'gitleaks/gitleaks-action' a2ml/.github/workflows/secret-scanner.yml"
+evidence = "secret-scanner.yml runs gitleaks/gitleaks-action plus rust-secrets and shell-secrets jobs on pull_request and push to main. TruffleHog was retired as redundant to the pinned gitleaks gate (#507/#525)."
+check = "test -f a2ml/.github/workflows/secret-scanner.yml && grep -q 'gitleaks/gitleaks-action' a2ml/.github/workflows/secret-scanner.yml"
 effects = "Prevents accidental credential leakage into repo history, which would otherwise require costly rotation/remediation across the hyperpolymath estate."
 
 [[should]]