fix(hypatia): farm token key → secret-name (scanner FP on 'secret = …'); drop root STATE.a2ml (SD004)

- git-private-farm.a2ml records only the secret's NAME, but the literal
  'secret = "…"' shape trips Hypatia's generic-secret detector (error-level,
  fails the gate). Renamed key to secret-name. No value was ever present.
- Root .machine_readable/STATE.a2ml (already pointer-ized to canonical
  6a2/STATE.a2ml) still triggered SD004 'a2ml outside 6a2/'; removed — the
  canonical file carries everything. Remaining root a2ml duplicates
  (META/ECOSYSTEM, pre-existing) stay tracked in the proposed issues.

https://claude.ai/code/session_01GJatEm2TVFSTBEkKXmserJ

Author: claude

.machine_readable/STATE.a2ml

@@ -14,7 +14,7 @@ enabled = true
 target = "hyperpolymath/.git-private-farm"
 event-type = "propagate"
 # Secret NAME only — value lives in GitHub Actions secrets.
-secret = "FARM_DISPATCH_TOKEN"
+secret-name = "FARM_DISPATCH_TOKEN"
 # Verified 2026-06-12: the dispatch step has NO if-guard checking the secret
 # is present; a fork/secretless run would fail rather than skip. Proposed as
 # an issue at the 2026-06-12 checkpoint.