fix(sandbox): allowlist README placeholder in .secrets.baseline

Fixes failing CI check: tekton/code-detect-secrets

The example env file snippet in sandbox/README.md tripped IBM's
detect-secrets scanner. Add the finding to .secrets.baseline — the
repo's existing convention (14 entries already present) — rather than
polluting the doc with inline pragmas. Change the placeholder to the
canonical sk-ant-xxxx form used elsewhere.

Author: vinodmut

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "^.secrets.baseline$|package-lock\\.json$",
     "lines": null
   },
-  "generated_at": "2026-04-20T15:55:53Z",
+  "generated_at": "2026-04-29T16:14:59Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -153,6 +153,15 @@
         "verified_result": null
       }
     ],
+    "sandbox/README.md": [
+      {
+        "hashed_secret": "b792a28a35da9b44fa0ee8a53002e9c238afb1bd",
+        "is_verified": false,
+        "line_number": 67,
+        "type": "Secret Keyword",
+        "verified_result": null
+      }
+    ],
     "sandbox/sample.env": [
       {
         "hashed_secret": "b792a28a35da9b44fa0ee8a53002e9c238afb1bd",
@@ -213,4 +222,4 @@
     "file": null,
     "hash": null
   }
-}
+}

sandbox/README.md

@@ -64,7 +64,7 @@ model):
 
 ```bash
 # Direct Anthropic API
-ANTHROPIC_API_KEY=sk-ant-...
+ANTHROPIC_API_KEY=sk-ant-xxxx
 
 # Or, via a proxy / gateway
 ANTHROPIC_AUTH_TOKEN=your-token