fix(secret-gate): a documented fake id must not stop the machine tier

The live-sync heartbeat failed three hourly ticks (22:25, 23:27, 00:28) because a
managed skill that documents how to write a secret gate quotes the vendor's
all-zeros placeholder access-key id, and the shape rule fired on the
documentation. The machine tier is prose ABOUT credentials — the gate's own header
says a gate that fires there gets overridden until it means nothing — and a
heartbeat that cannot commit is a fleet that silently stops syncing config.

- shape hits are judged on the matched token, not the line: a documented fake is
  inert, one live token sharing the file still blocks. The match is judged with
  its following context, because a fixed quantifier truncates `EXAMPLE` to `EXA`
  and the placeholder would vanish from what is examined.
- assignment values keep the stricter rule from the previous commit: a comment on
  the same line cannot vouch for the token beside it.
- `ALLOW_SECRETS` remains the only override; nothing here widens what is scanned,
  it only stops flagging text that was never a credential.

Verified against the payload that is stuck right now: the skill page that the
heartbeat cannot commit passes the fixed hook and was refused by the live one.

Refs #60

tests/secret-gate.bats

@@ -189,3 +189,16 @@ export API_KEY_FILE=/run/secrets/api_key'
   printf '%s\n' "$output" | grep -qx '  b/two.env'
   ! printf '%s\n' "$output" | grep -qE 'hunter2corp2026 +b/two\.env'
 }
+
+@test "a documented fake id in prose is committable; a live-shaped id in the same file is not" {
+  # Measured on blankpad 2026-10-21: the live-sync heartbeat failed three ticks in a row
+  # because a managed-skill page documents how to write a secret gate and quotes AWS's own
+  # placeholder id. A gate that blocks the machine tier over an inert example gets worked
+  # around, and a workaround is the hole. The exemption reads the matched token, so a real
+  # id in the same file still blocks.
+  try_commit "docs.md" 'Inert fixtures look like AKIAIOSFODNN7EXAMPLE or AKIA0000000000000EXAMPLE.'
+  [ "$status" -eq 0 ]
+  try_commit "docs.md" 'Inert fixture AKIAIOSFODNN7EXAMPLE and a live one AKIAQZR4W7DBPCFG7V3Q.'
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"docs.md"* ]]
+}