#1053 CI red on 16720f9: size allowlist stale after #1041, gitleaks tracked-tree findings unnamed

EARS SPEC: - The size gate shall pass on main: allowlist entries equal current line counts (api/tests/test_rbac_permissions.py 1070, tests/helpers/api_client.py 854). - When the gitleaks tracked-tree scan finds a leak, the CI log shall name RuleID, file and line for each finding, with secret values redacted, and the step shall still exit non-zero. - If a tracked file holds a gitleaks finding, then it shall be removed or, when it is a test placeholder, made a non-secret placeholder; never added to a path-wide allowlist. Pipeline 3801 (highway 16720f9): job 13857 size gate FAIL (two shrunk files); job 13856 gitleaks 'leaks found: 2' on the 7.98 MB tracked tree, log names no files. TECHNICAL PROBLEMS: 1. stale ratchet baseline; 2. scanner output without locations. SOLUTION DOMAINS: existing scripts/ci gates; gitleaks --report-path JSON with --redact (same as the history step). ALTERNATIVES: report in CI [CHOSEN: names files on every future failure, no vm-1 scan]; run gitleaks on vm-1 [REJECTED: director's CI-only rule].