Secret scanning for the agent era: verify the leak, then fix it

The pull request looked clean. The tests were green, the diff was small, and the commit message was tidy. Three lines deep in a config helper there was a real AWS access key that the coding agent had pasted in to make an example run. Nobody read those three lines, because nobody reads every line an agent writes anymore. When a person writes a secret into a file, it usually passes under someone's eyes before it reaches a commit. When an agent writes one, it often does not. The reviewer is either the same agent that wrote the code or a human skimming a 600 line diff.