#969 Secret history triage: gitleaks finds 45 (highway) + 8 (engine) historical findings; default rules missed the [secrets] mail password

EARS SPEC: - The Highway CI secret scan shall fail on any credential added to tracked files or history, proven red on planted positives including an INI 'key = value' under a [secrets] section. - For each historical gitleaks finding, the triage shall record: file, commit, credential type, whether it is still live (checked without printing the value), owner, and action (rotate / revoked / false positive). - If a historical credential is still live, then it shall be reported to the owner for rotation; history rewriting is out of scope (owner decision). - The CI history scan shall use a reviewed baseline (.gitleaksignore fingerprints) so only new findings fail. CONTEXT: gitleaks 8.30.1 (sha256 551f6f...), full history: highway 45 findings (docker/.env.local x7, scripts/export-sonar-metrics.sh x5, api/screenshot_with_auth.sh jwt x3, test.env x3, .claude/settings.local.json x2, CLAUDE.md jwt, ...), highway-engine 8, jumper 0. Known miss: docker/config.ini [secrets] mail (81bb4b4..4ba5d88~1), a real SMTP password that authenticated until 2026-10-20 — not flagged by default rules.