ci: mark deliberate secret-shaped test fixtures for rust-secrets

standards' `rust-secrets` job becomes blocking outside `./src` on
2026-08-21. The lines tagged here are genuine matches on genuine
secret-shaped literals — they are test data, not credentials — so they take
the explicit per-line pragma rather than a pattern loophole that would weaken
the gate for every repo.

fuzz/fuzz_targets/fuzz_hmac.rs holds a fixed HMAC key for the fuzz
harness; the file already says it is 'not the secret itself'.

Verified: `rust-secrets` (extracted from standards' shipping YAML) exits 0 on
this tree with RUST_TODAY=2026-09-01, i.e. after the cutoff.

Scope: this commit touches ONLY Rust sources. The secret-scanner re-pin is
deliberately NOT bundled — this repo is one of the 22 the sweep flagged, where
gitleaks findings survive the estate baseline, and switching it to the real
gate needs its own triage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

fuzz/fuzz_targets/fuzz_hmac.rs

@@ -14,7 +14,7 @@ use hmac::{Hmac, Mac};
 use sha2::Sha256;
 
 // Fixed secret — we're testing the parsing/comparison path, not the secret itself
-const SECRET: &[u8] = b"fuzz-test-secret-key-not-real";
+const SECRET: &[u8] = b"fuzz-test-secret-key-not-real";  // scanner-allow: rust-secrets
 
 fuzz_target!(|data: &[u8]| {
     // Split data: first 32 bytes treated as a "claimed signature", rest as body