feat(security): commit-time secret guard that FAILS the build on a committed credential

The 2026-09-17 purge removed six live credentials that had sat in this repo
for weeks, several in .md prose. Nothing blocked that class of commit, so a
warning in a stream nobody reads was the only signal. This adds a guard that
fails the build instead of warning.

Guard
- scripts/secret-scan.sh: bash + coreutils + grep/sed/awk + git only (the Gitea
  Actions runner executes job steps inside the runner container — BusyBox grep,
  no node/python). Modes: --tree (git-tracked, default), --path DIR (no git),
  --staged (pre-commit), --diff REF. Exit 1 on a finding, 2 on config error.
- scripts/secret-patterns.tsv: checked-in pattern list — sk-, sk-or-v1-,
  sk_live_, literal Bearer tokens, PVEAPIToken=, raw Authorization values, PEM
  private-key blocks, prose credential lines, and password/api_key/secret/token
  assignments carrying a literal value. Prose is scanned exactly like code.
- scripts/secret-allowlist.tsv: one entry per deliberate synthetic example, each
  with a reason. A missing reason is a hard error (fail closed). The 2026-09-17
  purge's `«vault: ...»` placeholders are listed explicitly rather than filtered
  by a general "vault"/"synthetic" rule, so a new occurrence still needs a
  reviewed, reasoned entry.
- A small inert-value classifier drops env refs, paths, dotted code access,
  variable names and right-truncated redactions; it does not know the words
  "synthetic"/"example", so a fabrication is always an explicit exception.
- Findings are printed with the credential masked; a scan never echoes a full
  secret into the log.

Wiring
- .gitea/workflows/pr-pipeline.yaml lint job: explicit "Committed-credential
  scan" step plus the self-test. A finding fails the required
  `pr-pipeline / lint` context, which the merge gate depends on.
- scripts/prose-lint.sh (the local gate): a "Secret scan" section, so
  `bash scripts/prose-lint.sh` before pushing is equivalent to CI.

Tests
- tests/test_secret_scan.sh: 20 cases. Plants pattern-matching fixtures in temp
  trees (outside every allowlisted path) and asserts the guard FAILS, including
  the --staged commit-time path; asserts the tree is quiet; asserts allowlisted
  text at an unlisted path still fails (path-explicit, not word-based); asserts
  a reasonless allowlist entry exits 2.

Verified: guard run against 8245716^ (the pre-fix revision, before the purge)
fails on the real OpenRouter/LiteLLM/Zulip/Proxmox/Stirling credentials; guard
run over the current tree is clean.

scripts/prose-lint.sh

@@ -135,7 +135,22 @@ fi
 
 echo "  Cross-contract: $WARNINGS total warnings across all checks"
 
-# ── 4. Summary ──
+# ── 4. Committed-credential scan ──
+# The 2026-09-17 purge removed six live credentials that had sat in .md prose
+# and scripts for weeks. This step makes that class of commit FAIL the gate
+# instead of printing a warning. Patterns: scripts/secret-patterns.tsv.
+# Only deliberate synthetic examples may be listed in scripts/secret-allowlist.tsv,
+# each with a reason. Run `bash scripts/secret-scan.sh --staged` before committing.
+echo ""
+echo "── 4. Secret scan (committed credentials) ──"
+if bash scripts/secret-scan.sh; then
+  echo "  ✅ No committed credentials"
+else
+  echo "  ❌ COMMITTED CREDENTIAL DETECTED"
+  FAILED=1
+fi
+
+# ── 5. Summary ──
 echo ""
 echo "═══════════════════════════════════"
 if [ $FAILED -eq 1 ]; then