docs: silence gitleaks false-positive on GPG fingerprint

gitleaks 8.24.3's `generic-api-key` rule matches any 40-char hex
string against an entropy threshold. The campaign manifest recorded
my public PGP signing-key fingerprint as `git-signing-key = "..."`,
which (correctly per the rule) looks like a 40-char hex API key.
Public key fingerprints are NOT secrets — they're meant to be
published — but the scanner has no way to tell that apart from a
secret.

Replaced the inline value with a comment explaining the situation
and pointing readers at `git log --show-signature` to recover the
fingerprint from any commit if they need to verify.

The `all-prs-gpg-signed = true` flag above remains the load-bearing
assertion for tooling.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

docs/audits/launcher-standard-review-2026-05-26.a2ml

@@ -236,4 +236,10 @@ review-method = "manual top-to-bottom read of launcher/ + docs/UX-standards/laun
 review-duration = "single session ~3 hours"
 all-prs-gpg-signed = true
 all-prs-independent-off-main = true
-git-signing-key = "9639451754496E51D6B537CAD119017EBF695AB1"
+# Signing-key fingerprint deliberately not recorded inline: gitleaks
+# misclassifies the 40-char hex as a generic-api-key. Public PGP
+# fingerprints are NOT secrets, but the scanner cannot distinguish
+# them from API keys of the same shape. The all-prs-gpg-signed flag
+# above is the load-bearing assertion; the fingerprint is recoverable
+# from `git log --show-signature` if anyone needs to verify against a
+# specific key.