chore(security): allowlist orchestration idempotencyKey test fixtures in gitleaks

CI secret-scan (gitleaks generic-api-key) false-positived on the
'orch_abc_SUB-1'-style idempotencyKey fixtures in the orchestration tests
(orchestration-release.test.ts / orchestration-reconciler.test.ts) — these
are made-up test values, not credentials. Scope a targetRules+paths
allowlist to those two test files, mirroring the existing wat-opaque-123 /
test-signing-secret-abc123 fixture exemptions. Range scan: no leaks found.

Author: isadeks

.gitleaks.toml

@@ -19,6 +19,17 @@ stopwords = ["wat-opaque-123"]
 description = "Test fixture signing secret in Slack verification unit test (not a real credential)."
 stopwords = ["test-signing-secret-abc123"]
 
+[[allowlists]]
+# #247: the orchestration idempotencyKey fixtures (`orch_<id>_<subissue>`) are
+# made-up test values, but generic-api-key flags the key-ish assignment. Scope
+# the exemption to the orchestration test files (no real credentials there).
+description = "Orchestration idempotencyKey test fixtures (not real credentials)."
+targetRules = ["generic-api-key"]
+paths = [
+    "^cdk/test/handlers/shared/orchestration-release\\.test\\.ts$",
+    "^cdk/test/handlers/orchestration-reconciler\\.test\\.ts$",
+]
+
 # Catch bare 12-digit AWS account IDs. The default ruleset does not flag these,
 # which is how a real account ID reached a committed comment in the #236 integ
 # work. RE2 (Go) has no lookarounds, so the non-digit neighbours are captured in