The estate-wide secret scan (infra#316) flags a fixture value in this repo
as a credential. Verified by reading the surrounding code that it is not
one, then scoped an allowlist to it.
Scoped by BOTH path and pattern (condition = "AND"), never path alone: a
path-only allowlist would blind this file to a future REAL secret, which is
how a live token hid inside a file whose name read as safe (infra#256).
Allowlist by shape, not by filename.
Adds .gitleaks.toml where there was none, so this repo is no longer scanned
with bare defaults.
