fix: allowlist mock workload access token in gitleaks config

The context-hydration test uses `wat-opaque-123` as a mock workload
access token. Gitleaks flags this as a generic-api-key false positive
across all commits. Add a path-scoped allowlist entry to suppress it.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: scottschreckengaust

.gitleaks.toml

@@ -10,3 +10,10 @@ paths = [
     "^agent/tests/test_hooks\\.py$",
     "^agent/tests/test_output_scanner\\.py$",
 ]
+
+[[allowlists]]
+description = "Mock workload access token in CDK handler tests (not a real credential)."
+targetRules = ["generic-api-key"]
+paths = [
+    "^cdk/test/handlers/shared/context-hydration\\.test\\.ts$",
+]