feat(enrichment): gitleaks-grade secret scan analyzer with value redaction

[JSONbored]

Context

Secret-scan analyzer for the review-enrichment service (REES). Depends on the scaffold. The engine already has a regex secret scan over the diff (scanForSecrets); REES adds a higher-recall entropy + gitleaks-ruleset scan over FULL file bodies, line-cited, with false-positive suppression — and CRITICALLY renders findings so the secret VALUE is never embedded (cite kind+line only), matching content-lane/security-scan.ts discipline.

Requirements

• High-recall scan over the request file bodies/patches: entropy heuristics + a gitleaks-grade ruleset; line-cited findings with FP suppression (.gitleaks.toml/allowlist support).
• Redaction is mandatory and enforced at render time: a leaked-token finding embeds kind+line+confidence, NEVER the token value. This is a public-safety invariant — the rendered promptSection passes through the redaction pass so a leaked token can never reach the model prompt verbatim.
• Own sub-budget; degrades independently.

Deliverables

• review-enrichment/src/analyzers/secret-scan.ts: entropy + ruleset scan → secret findings [{ file, line, kind, confidence }] (NO value field).
• Ensure render.ts redaction covers any path a value could leak; register in brief.ts (gated by enrichment.analyzers), add secret to analyzerStatus. Optionally bake the gitleaks ruleset into the image.

Acceptance criteria

• A planted AWS key / generic high-entropy secret is detected with kind+line; an allowlisted/FP pattern is suppressed.
• INVARIANT test: the rendered promptSection for a secret finding NEVER contains the secret value (only kind/line/confidence) — assert this explicitly.
• Scan error degrades that analyzer only. Unit tests cover detection, FP suppression, and the redaction invariant. npm audit --audit-level=moderate clean.

Parent: #1029