fix(secret-gate): a documented fake id must not stop the machine tier

The live-sync heartbeat failed three hourly ticks (22:25, 23:27, 00:28) because a
managed skill that documents how to write a secret gate quotes the vendor's
all-zeros placeholder access-key id, and the shape rule fired on the
documentation. The machine tier is prose ABOUT credentials — the gate's own header
says a gate that fires there gets overridden until it means nothing — and a
heartbeat that cannot commit is a fleet that silently stops syncing config.

- shape hits are judged on the matched token, not the line: a documented fake is
  inert, one live token sharing the file still blocks. The match is judged with
  its following context, because a fixed quantifier truncates `EXAMPLE` to `EXA`
  and the placeholder would vanish from what is examined.
- assignment values keep the stricter rule from the previous commit: a comment on
  the same line cannot vouch for the token beside it.
- `ALLOW_SECRETS` remains the only override; nothing here widens what is scanned,
  it only stops flagging text that was never a credential.

Verified against the payload that is stuck right now: the skill page that the
heartbeat cannot commit passes the fixed hook and was refused by the live one.

Refs #60

.githooks/pre-commit

@@ -79,7 +79,24 @@ while IFS= read -r -d '' f; do
   # gate refused the redaction of the password it exists to catch.
   added=$(printf '%s\n' "$diff" | grep -E '^\+' | grep -vE '^\+\+\+' | sed 's/^+//' || true)
   [ -z "$added" ] && continue
-  hits=$(printf '%s\n' "$added" | grep -Ei "$shapes" || true)
+  # Shape hits are judged on the MATCHED TOKEN, not on the whole line. Documentation about
+  # credentials quotes vendor placeholders — AWS publishes an all-zeros access-key id that ends
+  # in EXAMPLE for exactly this purpose — and
+  # a gate that blocks prose over an inert example gets worked around until it means nothing:
+  # the live-sync heartbeat failed three ticks on 2026-10-21 because a managed skill page quotes
+  # exactly that id. A line is exempted only when EVERY shape on it is inert, so one live token
+  # sharing the file with a documented fake still blocks.
+  hits=$(printf '%s\n' "$added" | while IFS= read -r line; do
+           live=0
+          while IFS= read -r m; do
+            # The shape regexes carry fixed quantifiers, so the match they return is TRUNCATED:
+            # `AKIA` + exactly 16 characters stops inside the word EXAMPLE and the placeholder
+            # disappears from what is judged. Judge the match plus what follows it instead.
+            ctx=$(printf '%s' "$line" | awk -v m="$m" '{ i = index($0, m); print (i > 0 ? substr($0, i, length(m) + 8) : m) }')
+            printf '%s' "$ctx" | grep -Eiq 'EXAMPLE|X{4,}|Y{4,}|Z{4,}|_{4,}|REDACTED|CHANGEME|PLACEHOLDER' || live=1
+          done < <(printf '%s\n' "$line" | grep -Eio "$shapes" || true)
+           [ "$live" = 1 ] && printf '%s\n' "$line"
+         done)
   if [ "${f##*.}" != "md" ]; then
     # The placeholder filter reads the VALUE, never the whole line. A trailing comment that
     # says `# example` says nothing about the token the same line assigns; scoping the filter