fix(scan): drop the paths clause that granted whole-file immunity

infra#344. gitleaks ORs the clauses of a GLOBAL `[[allowlists]]` block and does
not honour `condition = "AND"` there, so the `paths` entry suppressed EVERY
finding in the named file — not only the false positive the `regexes` line
describes. The regex alone is what was meant, and it works regardless of which
file the value turns up in (infra#256).

Verified rather than assumed, with a control for the probe itself: a live-shaped
credential planted in the formerly-exempt file scans clean before this change and
fires after it, and the same shape fires in a neutral path both ways (so "not
detected" cannot be mistaken for "immune"). The intended false positive is still
suppressed — the tree scans clean.

Refs: mathias/infra#344, mathias/infra#256, mathias/infra#317

.gitleaks.toml

@@ -17,10 +17,11 @@ useDefault = true
 # credential and has no secret analogue.
 [[allowlists]]
 description = "infra#317 — METRIC_KEY is a metrics identifier, not a credential"
-condition = "AND"
+# infra#344: `paths` removed. gitleaks ORs the clauses of a GLOBAL allowlist and
+# does not honour `condition = "AND"` there, so the path matched on its own and
+# granted the whole file immunity — every finding in it, not just this one.
+# Verified: a live-shaped credential planted in that file scanned clean before
+# this change and fires after it. The regex below is what was meant and works
+# regardless of which file the value appears in (infra#256).
 regexTarget = "line"
-paths = [
-  '''(^|/)scripts/var_breach\.py$''',
-  '''(^|/)tests/test_var_metric\.py$''',
-]
 regexes = ['''METRIC_KEY''']