V3 local secret-discovery capability pack. By-value connector composition (service_kind=cli, no separate ingredient): one local trufflehog CLI ingredient exposes bounded operations for readiness, filesystem secret scans, and local Git-history secret scans. Filesystem scans accept one trusted file or directory and Git scans run from an explicit project directory cwd against file://.; both return JSONL findings. Fixed-function and reproducible at the invocation boundary: JSON output, no verification/API login checks, no update check, no GitHub/GitLab/cloud/container/CI/Elasticsearch/Jenkins/Postman sources, no caller-supplied config, no custom verifier endpoints, no detector include/exclude lists, no archive expansion, no output-file write, no stdin, no arbitrary flags, and no shell wrapper. Findings use TruffleHog's --fail exit code and are represented as successful JSONL output; real scan errors still fail. Requires trufflehog on PATH. Local and no-egress when used with --no-verification and --no-update.