chore(security): commit the Aug 29 scanner update left uncommitted here

The 2026-08-29 cross-project update of scripts/secrets.sh reached this
checkout as a working-tree edit and was never committed. For the twelve days
since, .githooks/pre-push refused every push, because a tracked file was
modified, so nothing else could land.

Committed as-is, by Null's decision, so the work that follows can push. What
the change does:

- the bare NAME=value pattern can now match. It was anchored to the start of
  a line, and neither scan mode ever presents one: a staged diff starts every
  line with "+", and --tracked prefixes each line with its file name.
- a commit that only deletes lines is no longer refused as a possible
  credential. Staged mode reads added lines only, so "nothing to scan" there
  is a correct measurement, not a failure to measure.

Known, and fixed in the next security commit (Batch 18): the new pattern
flags two comment lines, so `npm run verify` fails until then, and the
private-key pattern still never runs because grep is called without -e.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/secrets.sh

@@ -170,7 +170,7 @@ PATTERNS=(
   # Anchored to the start of a line or an `export`, because unanchored it
   # matched `access_token = $1` in SQL and `apiKey=` in a property list — three
   # findings in src/ that were column names, not credentials.
-  '(^|export )[A-Z][A-Z0-9_]*(SECRET|TOKEN|PASSWORD|API_KEY|PASSWD)[A-Z0-9_]*=[^[:space:]"'"'"']{8,}'
+  '(^|[^A-Za-z0-9_])[A-Z0-9_]*(SECRET|TOKEN|PASSWORD|PASSWD|PASS|API_KEY)[A-Z0-9_]*=[^[:space:]"'"'"'$][^[:space:]"'"'"']{7,}'
   '-----BEGIN [A-Z ]*PRIVATE KEY-----'
   '\bghp_[A-Za-z0-9]{20,}'                              # GitHub
   '\bxox[baprs]-[A-Za-z0-9-]{10,}'                      # Slack
@@ -278,6 +278,16 @@ else
 fi
 
 if [ -z "$CONTENT" ]; then
+  # "Nothing to scan" means two different things and collapsing them makes a
+  # DELETE-ONLY COMMIT IMPOSSIBLE. In staged mode CONTENT is built from ADDED
+  # lines only, so a commit that only deletes has none — a correct measurement,
+  # not a failure to measure, because a deletion cannot introduce a credential.
+  # In tracked/built mode empty means nothing was examined at all, which IS the
+  # could-not-check state exit 2 exists to name.
+  if [ "$MODE" = "staged" ]; then
+    say "no added lines in $WHAT — a deletion cannot introduce a credential."
+    exit 0
+  fi
   say "nothing to scan in $WHAT."
   exit 2
 fi