fix(ci): stop .hypatia-ignore tripping its own secret scanner

The suppression comments added in #43 quoted the literal fixture strings
they were documenting (PASSWORD=…, API_KEY=…). `.hypatia-ignore` is not in
Hypatia's @universal_excludes, so the scanner reads the file and flagged
those quotes as two new `secret_detected` criticals (lines 15/17) — which
also turned the gating Hypatia code-scanning check red on main.

Describe the fixtures generically instead of quoting them, and add
`security_errors/secret_detected:.hypatia-ignore` so the suppression file
exempts itself (its comments necessarily name secret-detection rules and
paths). Verified against the scanner source: no assignment-style trigger
patterns remain, and the self-exemption matches .hypatia-ignore while the
seven real suppressions are unaffected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LvsZgNxFbeqfRmrVFNhJ8G

Author: claude

.hypatia-ignore

@@ -12,10 +12,13 @@
 
 # --- Test-fixture "secrets" (not credentials) ---------------------------------
 # gitleaks, trufflehog, rust-secrets and shell-secrets all pass clean on these.
-#   fuzz_config.zig:58 — fuzzer seed string ("PASSWORD='quoted'\nAPI_KEY=...")
-#     exercising the ENV config parser; literal test input.
-#   .envrc:24 — commented-out placeholder (# export API_KEY="..."); real
-#     secrets live in the gitignored .env loaded via dotenv_if_exists.
+#   fuzz_config.zig:58 — a fuzzer seed string of fake credential-style key/value
+#     lines exercising the ENV config parser; literal test input, not a secret.
+#   .envrc:24 — a commented-out example line; real secrets live in the
+#     gitignored .env loaded via dotenv_if_exists.
+# This file necessarily names secret-detection rules and paths, so it also
+# exempts itself: its own comments are documentation, not leaked credentials.
+security_errors/secret_detected:.hypatia-ignore
 security_errors/secret_detected:src/interface/ffi/src/fuzz_config.zig
 security_errors/secret_detected:.envrc