docs(ci): fix secret-scan reusable workflow self-doc — repo is molecule-core, ref is @staging

[HongmingWang-Rabbit]

[Molecule-Platform-Evolvement-Manager]

Follow-up to #2109. The canonical secret-scan workflow's own self-documented enrollment example referenced Molecule-AI/molecule-monorepo/.github/workflows/secret-scan.yml@main which is wrong on two counts:

1. Repo is molecule-core, not molecule-monorepo. The repo was renamed at some point; molecule-monorepo is now a redirect alias (which is why the audit log review surfaced 169 'agent events on molecule-monorepo orphan' — those are events on the redirect, not a real orphaned repo).
2. Ref must be @staging not @main. Staging is the active default branch; main lags behind via the staging-promotion workflow.

Discovered while shipping the rollout PRs to molecule-controlplane (cp#286) and molecule-ai-workspace-runtime (#57) — both initially failed CI because the path resolved to a non-existent workflow. Fixed in both consumer PRs in the same iter; this PR fixes the canonical self-doc so future operators copy the right snippet.

Test plan

• CI green (this PR has no behavioural change — it's a comment edit)
• Post-merge: cp#286 + runtime#57 both pass after their consumer-side fixes propagate

[HongmingWang-Rabbit]

Self-review (5-axis pass)

Correctness: ✓ Both corrections match reality — the canonical secret-scan.yml lives in molecule-core (not molecule-monorepo, which doesn't have it), and @main doesn't have it yet because monorepo's #2109 merged to staging only and the staging→main promote hasn't run. @staging is the only ref that resolves today. (Same root cause that broke CP #286.)

Tests: N/A — pure documentation change.

Architecture: ✓ Pinning external consumers to @staging is a known trade-off vs SHA-pinning; the inline note flags that staging is the active default branch and updates ride along automatically. Acceptable for the org-wide convenience pattern.

Security: N/A.

Performance: N/A.

LGTM. Auto-merge armed.