fix: baseline gitleaks false-positive test fixture (#530) (#534)

gitleaks flagged a generic-api-key on the test idempotency-key fixture
'orch_abc_SUB-1' in cdk/test/handlers/shared/orchestration-release.test.ts.
The file no longer exists at HEAD (removed when #76's perf commit was
reverted in e8bee5e); the finding survives only in history at f98f47a and
can't be removed without rewriting shared main. Baseline the fingerprint
in .gitleaksignore, matching the existing #313 pattern.

Verified: `mise run security:secrets` -> "no leaks found" (exit 0).

Fixes #530

Co-authored-by: Mandeep Singh <mandeep408@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: mandeep408

.gitleaksignore

@@ -5,3 +5,10 @@
 0dca2171f244f693ac7c649ecf376d1ce6af2b38:docs/backlog/EARLY_PROGRESS_MILESTONES.md:aws-account-id:5
 0dca2171f244f693ac7c649ecf376d1ce6af2b38:docs/backlog/CLI_COGNITO_NEW_PASSWORD_CHALLENGE.md:aws-account-id:5
 0dca2171f244f693ac7c649ecf376d1ce6af2b38:docs/diagrams/phase3-cedar-hitl.drawio:aws-account-id:28
+
+# False positive: generic-api-key on a test idempotency-key fixture
+# ('orch_abc_SUB-1', not a real credential) in a file that no longer exists at
+# HEAD — it was removed when the #76 bounded-parallel perf commit was reverted
+# (e8bee5e). The finding lives only in history at f98f47a, so it can't be
+# scrubbed without rewriting shared `main`; fingerprint it instead. See #530.
+f98f47abc6f7820d7e5ce0375cf22551cb664b37:cdk/test/handlers/shared/orchestration-release.test.ts:generic-api-key:125