ci: mark deliberate secret-shaped test fixtures for rust-secrets (#81)

standards' `rust-secrets` job becomes **blocking outside `./src`** on
**2026-08-21** (warn-first window from standards#518).

The lines tagged here are **genuine matches on genuine secret-shaped
literals** — they are test data, not credentials. So they take an
explicit, auditable per-line pragma rather than a pattern loophole that
would weaken the gate for every repo in the estate.

```rust
// scanner-allow: rust-secrets
```

## Why a pragma and not a pattern change

standards#523 already tightens the patterns to require an assignment
**directly to a string literal** of length ≥ 8, which removes the real
false positives estate-wide (lookups, path joins, prose). What remains
here genuinely *is* an assignment of a secret-shaped literal — it just
happens to be fixture data. Loosening the pattern to hide it would blind
the gate everywhere.

## Fixture integrity

Where the pragma sits **outside** the `r#"…"#` raw string (after the
closing quote/comma) it is an ordinary Rust comment and the fixture
content is **byte-identical** — the tests exercise exactly the same
data.

Where it sits **inside** a multi-line fixture, it is a JS-style comment
within fake content and does not change what the test asserts.

## Verified

`rust-secrets`, extracted from standards' shipping YAML, exits **0** on
this tree with `RUST_TODAY=2026-09-01` — i.e. after the cutoff, when the
check is blocking.

## Scope

**Only Rust sources.** The secret-scanner re-pin is deliberately not
bundled: this repo is one of the 22 the estate sweep flagged, where
gitleaks findings survive the shared baseline, and moving it onto the
real gate needs its own triage.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

benches/oracle_bench.rs

@@ -66,7 +66,7 @@ fn secret_proposal() -> Proposal {
         action_type: ActionType::CreateFile {
             path: "src/config.rs".to_string(),
         },
-        content: r#"let api_key = "supersecretkey12345""#.to_string(),
+        content: r#"let api_key = "supersecretkey12345""#.to_string(),  // scanner-allow: rust-secrets
         files_affected: vec!["src/config.rs".to_string()],
         llm_confidence: 0.9,
     }

src/contract/src/lib.rs

@@ -1565,7 +1565,7 @@ mod tests {
         let runner = ContractRunner::new();
         let request = GatingRequest::new(create_proposal(
             "config.rs",
-            r#"let password = "supersecret123456""#,
+            r#"let password = "supersecret123456""#,  // scanner-allow: rust-secrets
         ));
 
         let decision = runner.evaluate(&request).unwrap();

src/oracle/src/lib.rs

@@ -729,7 +729,7 @@ mod tests {
             action_type: ActionType::CreateFile {
                 path: "config.rs".to_string(),
             },
-            content: r#"let password = "supersecretpassword123""#.to_string(), // test fixture
+            content: r#"let password = "supersecretpassword123""#.to_string(), // test fixture — scanner-allow: rust-secrets
             files_affected: vec!["config.rs".to_string()],
             llm_confidence: 0.9,
         };
@@ -766,7 +766,7 @@ mod tests {
             action_type: ActionType::CreateFile {
                 path: "main.ts".to_string(),
             },
-            content: r#"const x: string = 'hello'; let password = "secret123""#.to_string(),
+            content: r#"const x: string = 'hello'; let password = "secret123""#.to_string(),  // scanner-allow: rust-secrets
             files_affected: vec!["main.ts".to_string()],
             llm_confidence: 0.9,
         };
@@ -1048,7 +1048,7 @@ mod tests {
             action_type: ActionType::CreateFile {
                 path: "config.rs".to_string(),
             },
-            content: r#"const API_KEY = "abcdef1234567890abcdef""#.to_string(), // test fixture
+            content: r#"const API_KEY = "abcdef1234567890abcdef""#.to_string(), // test fixture — scanner-allow: rust-secrets
             files_affected: vec!["config.rs".to_string()],
             llm_confidence: 0.9,
         };

tests/gating_pipeline_test.rs

@@ -78,7 +78,7 @@ fn e2e_hardcoded_secret_blocked() {
     let runner = ContractRunner::new();
     let proposal = create_proposal(
         "config.rs",
-        r#"const password = "supersecretpassword123456789abcde""#,
+        r#"const password = "supersecretpassword123456789abcde""#,  // scanner-allow: rust-secrets
     );
     let request = GatingRequest::new(proposal);
 

tests/security_aspect_test.rs

@@ -309,7 +309,7 @@ fn security_forbidden_pattern_detection() {
 
     // Test secret patterns
     let secret_patterns = vec![
-        r#"password = "thisisasecret123456""#,
+        r#"password = "thisisasecret123456""#,  // scanner-allow: rust-secrets
         r#"secret = "thisisasecret123456""#,
         r#"api_key = "thisisasecret123456""#,
     ];