ci(testbox): provision pinned TruffleHog (#112482)

* ci(testbox): provision pinned TruffleHog

* fix(ci): preserve existing TruffleHog bin directory

* test(ci): cover TruffleHog target routing

.github/actions/setup-node-env/action.yml

@@ -11,6 +11,10 @@ inputs:
     description: Whether to install Bun alongside Node.
     required: false
     default: "true"
+  install-trufflehog:
+    description: Whether to install the pinned TruffleHog binary for a reusable test environment.
+    required: false
+    default: "false"
   install-deps:
     description: Whether to run pnpm install after environment setup.
     required: false
@@ -97,6 +101,11 @@ runs:
         node-version: ${{ inputs.node-version }}
         use-actions-cache: ${{ inputs.use-actions-cache }}
 
+    - name: Setup TruffleHog
+      if: inputs.install-trufflehog == 'true'
+      shell: bash
+      run: bash scripts/install-trufflehog.sh
+
     - name: Validate sticky pnpm layout
       if: inputs.sticky-disk == 'true'
       shell: bash

.github/workflows/ci-build-artifacts-testbox.yml

@@ -91,6 +91,7 @@ jobs:
         uses: ./.github/actions/setup-node-env
         with:
           install-bun: "false"
+          install-trufflehog: "true"
 
       - name: Resolve release dist cache seeds
         id: dist-cache-seeds

.github/workflows/ci-check-arm-testbox.yml

@@ -105,6 +105,7 @@ jobs:
         uses: ./.github/actions/setup-node-env
         with:
           install-bun: "false"
+          install-trufflehog: "true"
       - name: Prepare Testbox shell
         shell: bash
         run: |

.github/workflows/ci-check-testbox.yml

@@ -97,6 +97,7 @@ jobs:
         uses: ./.github/actions/setup-node-env
         with:
           install-bun: "false"
+          install-trufflehog: "true"
       - name: Prepare Testbox shell
         shell: bash
         run: |