[SCAN-423][chore] Trim secret-scan comments and CONTRIBUTING section

Author: gmanal

.github/workflows/secret-scan-pulse.yml

@@ -5,7 +5,7 @@
 # CI secret-scan enforcement via NVIDIA/security-workflows (Pulse).
 # Runs on Linux nv-gha-runners (Pulse Docker image + OIDC/Vault) — Linux-only by design.
 # The local secret-scan-trufflehog pre-commit hook is cross-platform (Linux/macOS/Windows via Git Bash).
-# Pinned to a reviewed commit SHA; bump when NVIDIA/security-workflows consolidates.
+# Pinned to a reviewed commit SHA.
 
 name: Secret Scan (Pulse)
 
@@ -14,21 +14,19 @@ on:
     branches:
       - main
       - ctk-next
-      # copy-pr-bot mirror branches — trusted PR execution context
       - "pull-request/[0-9]+"
   workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-on-${{ github.event_name }}-from-${{ github.ref_name }}
   cancel-in-progress: true
 
-# Caller must grant at least every permission the reusable workflow declares
-# (a reusable workflow requesting more than the caller allows fails at load time).
+# Caller must grant every permission the reusable workflow declares.
 permissions:
   contents: read
   id-token: write          # OIDC -> Vault -> nvcr.io image pull
   security-events: write   # publish redacted SARIF to code scanning
-  actions: read            # reusable workflow declares actions: read (upload-sarif)
+  actions: read
 
 jobs:
   secret-scan:

CONTRIBUTING.md

@@ -77,12 +77,7 @@ warning reminding you to run `pre-commit install`.
 
 ## Secret Scanning
 
-Two complementary controls prevent accidental credential leakage:
-
-- **Local pre-commit** (`secret-scan-trufflehog`, via `.pre-commit-config.yaml`): catches credentials before commit. Self-installing — no manual setup beyond `pre-commit install`; the hook downloads a pinned, checksum-verified `trufflehog` on first use. Never commit a flagged secret; check with maintainers on false positives, and only use `git commit --no-verify` in exceptional, agreed cases.
-- **Server-side enforcement** (Pulse reusable workflow from `NVIDIA/security-workflows`, pinned by SHA): runs on `main`, `ctk-next`, and trusted copy-pr-bot branches on Linux runners, and blocks merges on verified secrets.
-
-The local hook is skipped on hosted pre-commit.ci (no `trufflehog` binary there); Pulse remains the authoritative CI enforcement. On **Windows**, run the hook from a Git Bash / MSYS shell (bundled with Git for Windows), which the hook requires; the CI (Pulse) control is Linux-runner-only by design.
+The `secret-scan-trufflehog` pre-commit hook scans staged files and installs TruffleHog on first run (use Git Bash on Windows). If it flags a secret, remove it before committing, or contact a maintainer if it's a false positive. Secrets are also scanned server-side in CI.
 
 
 ## Signing Your Work