feat(health): vendor-shaped credential detection — twelve families that were invisible #5616

Prompted by the GateTest engine's mirror-direction check: can a reassuring variable NAME silence a real credential? Measuring that exposed something bigger.

Measured before building

Of fourteen common credential families, the scanner detected two — AWS access keys and RSA/EC PEM. Invisible, in source and docs alike: GitHub tokens (ghp_/github_pat_), Stripe live keys, Slack tokens, Google API keys, OpenAI, Anthropic, GitLab PATs, npm tokens, SendGrid keys, and OPENSSH/DSA/PGP private keys.

OPENSSH has been ssh-keygen's default output since 7.8 — three of the five common private-key headers were invisible to a rule named no-private-keys.

Why this family is different

The prefix and charset are the credential. No value heuristic, no language scoping, no prose scoping:

• a vendor key in a README is a leaked vendor key — this fires everywhere, which is what widening the file set was for
• placeholder_secret holding a real Stripe key still fires, because nothing consults the name — the exact inverse of the CELITECH_TOKEN_URL bug
• sk_live_YOUR_KEY_HERE cannot fire: the charsets exclude _/- inside the random run where the vendor's alphabet does, so templates break before the length requirement
• only live-mode Stripe prefixes match — sk_test_ is in half the payment tutorials ever written

The first attempt shipped dead

A tooling step turned every \b word boundary into a literal 0x08 BACKSPACE character. The file compiled, the regexes were valid, and each matched only lines containing a backspace — nothing, ever. A standalone probe of "the same" regex passed because it was typed fresh, so the tool and its probe disagreed until cat -A showed ^H.

A rule that cannot match is indistinguishable from a rule with no bug to find — same family as the deleted fallback scan and GateTest's unreachable +3 bonus. The suite now asserts the entire rules module is free of C0 control bytes.

Verification

• 18 tests: ten families firing under reassuring names, docs-firing, template non-firing, modern PEM headers, and the control-byte guard.
• Fixtures assembled at runtime (both this repo's push gate and GitHub push protection have rejected literal fixtures this week — correctly).
• Diff pre-flighted against the deployed merge-time scanners: 0 findings.
• Full suite: 5,447 pass, 11 fail — unchanged baseline.