ci: mark deliberate secret-shaped test fixtures for rust-secrets

standards' `rust-secrets` job becomes blocking outside `./src` on
2026-08-21. The lines tagged here are genuine matches on genuine
secret-shaped literals — they are test data, not credentials — so they take
the explicit per-line pragma rather than a pattern loophole that would weaken
the gate for every repo.

These are this repo's OWN secret-detection fixtures. Every pragma sits
OUTSIDE the r#"…"# raw string (after the closing quote / comma), so it is an
ordinary Rust comment and the fixture content is byte-identical — the tests
exercise exactly the same data as before.

Verified: `rust-secrets` (extracted from standards' shipping YAML) exits 0 on
this tree with RUST_TODAY=2026-09-01, i.e. after the cutoff.

Scope: this commit touches ONLY Rust sources. The secret-scanner re-pin is
deliberately NOT bundled — this repo is one of the 22 the sweep flagged, where
gitleaks findings survive the estate baseline, and switching it to the real
gate needs its own triage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

benches/oracle_bench.rs

@@ -66,7 +66,7 @@ fn secret_proposal() -> Proposal {
         action_type: ActionType::CreateFile {
             path: "src/config.rs".to_string(),
         },
-        content: r#"let api_key = "supersecretkey12345""#.to_string(),
+        content: r#"let api_key = "supersecretkey12345""#.to_string(),  // scanner-allow: rust-secrets
         files_affected: vec!["src/config.rs".to_string()],
         llm_confidence: 0.9,
     }

src/contract/src/lib.rs

@@ -1565,7 +1565,7 @@ mod tests {
         let runner = ContractRunner::new();
         let request = GatingRequest::new(create_proposal(
             "config.rs",
-            r#"let password = "supersecret123456""#,
+            r#"let password = "supersecret123456""#,  // scanner-allow: rust-secrets
         ));
 
         let decision = runner.evaluate(&request).unwrap();

src/oracle/src/lib.rs

@@ -729,7 +729,7 @@ mod tests {
             action_type: ActionType::CreateFile {
                 path: "config.rs".to_string(),
             },
-            content: r#"let password = "supersecretpassword123""#.to_string(), // test fixture
+            content: r#"let password = "supersecretpassword123""#.to_string(), // test fixture — scanner-allow: rust-secrets
             files_affected: vec!["config.rs".to_string()],
             llm_confidence: 0.9,
         };
@@ -766,7 +766,7 @@ mod tests {
             action_type: ActionType::CreateFile {
                 path: "main.ts".to_string(),
             },
-            content: r#"const x: string = 'hello'; let password = "secret123""#.to_string(),
+            content: r#"const x: string = 'hello'; let password = "secret123""#.to_string(),  // scanner-allow: rust-secrets
             files_affected: vec!["main.ts".to_string()],
             llm_confidence: 0.9,
         };
@@ -1048,7 +1048,7 @@ mod tests {
             action_type: ActionType::CreateFile {
                 path: "config.rs".to_string(),
             },
-            content: r#"const API_KEY = "abcdef1234567890abcdef""#.to_string(), // test fixture
+            content: r#"const API_KEY = "abcdef1234567890abcdef""#.to_string(), // test fixture — scanner-allow: rust-secrets
             files_affected: vec!["config.rs".to_string()],
             llm_confidence: 0.9,
         };

tests/gating_pipeline_test.rs

@@ -78,7 +78,7 @@ fn e2e_hardcoded_secret_blocked() {
     let runner = ContractRunner::new();
     let proposal = create_proposal(
         "config.rs",
-        r#"const password = "supersecretpassword123456789abcde""#,
+        r#"const password = "supersecretpassword123456789abcde""#,  // scanner-allow: rust-secrets
     );
     let request = GatingRequest::new(proposal);
 

tests/security_aspect_test.rs

@@ -309,7 +309,7 @@ fn security_forbidden_pattern_detection() {
 
     // Test secret patterns
     let secret_patterns = vec![
-        r#"password = "thisisasecret123456""#,
+        r#"password = "thisisasecret123456""#,  // scanner-allow: rust-secrets
         r#"secret = "thisisasecret123456""#,
         r#"api_key = "thisisasecret123456""#,
     ];