WP5 pre-ingest secret scanner

[tachyon-beep]

Summary

• add Rust-native clarion-scanner with ADR-013 rule floor and detect-secrets v1 baseline support
• wire analyze pre-ingest scanning, audited overrides, file anchors, and unscanned-source blocks
• make MCP summary and inferred-edge LLM dispatch respect briefing blocks
• document operator workflow and add WP5 e2e smoke to CI

Review

• ran local PR review via codex exec; fixed .env/plugin-env leakage, baseline path/type matching, file anchors, multi-entry baseline errors, wrong-token override coverage, invalid baseline path rejection, padded base64 entropy detection, private-key header coverage, explicit baseline is_secret semantics, and inferred-edge LLM gating for blocked callers

Verification

• cargo fmt --all -- --check
• git diff --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo build --workspace --bins
• cargo test --workspace --all-features
• cargo nextest run --workspace --all-features
• env RUSTDOCFLAGS=-Dwarnings cargo doc --workspace --no-deps --all-features
• cargo deny check
• python scripts/check-migration-retirement.py --self-test
• python scripts/check-migration-retirement.py
• python scripts/check-b4-gate-result.py
• python scripts/check-python-ontology-version.py --self-test
• python scripts/check-python-ontology-version.py
• plugins/python/.venv/bin/ruff check plugins/python
• plugins/python/.venv/bin/ruff format --check plugins/python
• plugins/python/.venv/bin/mypy --strict plugins/python
• plugins/python/.venv/bin/pytest plugins/python
• CARGO_BUILD=0 bash tests/e2e/wp5_secret_scan.sh
• bash tests/e2e/sprint_1_walking_skeleton.sh