fix(review): stop generic_secret_assignment false-flagging self-naming fixture/enum values

[JSONbored]

Summary

Confirmed live false positives across all three repos this rule covers — none had a real secret present, yet all closed the PR outright (or, for REES, produced a noisy advisory finding):

• metagraphed/gittensory#4524 — token = "default-session-token" / "beta-session-token" (test fixtures)
• awesome-claude#4758 — embedded_secret: "unsafe_install_or_secret" (an enum/category label)

Root cause: isPlaceholderSecretValue's existing fixture carve-out only recognized an exact two-segment lowercase-hyphenated value assigned to a literal token key (^[a-z]+-[a-z]+$) — missing 3+-segment fixtures and any key name other than token entirely.

Fix: a narrower, evidence-driven check — a value whose own last segment self-names as a secret kind (ends in -token/-secret/-key/-password/-passwd) reads as a NAME for a concept, not an opaque credential. Deliberately narrower than "any multi-segment lowercase phrase": a real Diceware-style passphrase like "alpha-bravo-charlie-delta" (an existing, deliberate test case) still correctly flags.

Applied identically across all three independent copies of this heuristic (each self-contained by design, no cross-package imports):

• src/review/secrets-scan.ts — feeds the deterministic hard-block gate (safety.ts)
• src/review/content-lane/security-scan.ts — awesome-claude content-lane submissions
• review-enrichment/src/analyzers/secret-scan.ts — REES's own standalone-deployed (Railway) advisory analyzer, which previously did no placeholder filtering at all for this kind, so its briefs were even noisier than the two hard-blocking copies

Test plan

• New regression tests in all three copies' test suites for both confirmed false positives, plus a guard that a generic multi-segment passphrase not ending in a trigger word still flags
• npm run typecheck, full npm run test:coverage, npm run test:ci (all green)
• review-enrichment's own npm test (1220 tests, separate Node test runner + sourcemap/metadata checks) — all green

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.12%. Comparing base (6e1493a) to head (bb672e2).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4587   +/-   ##
=======================================
  Coverage   94.12%   94.12%           
=======================================
  Files         430      430           
  Lines       38167    38171    +4     
  Branches    13917    13918    +1     
=======================================
+ Hits        35924    35928    +4     
  Misses       1585     1585           
  Partials      658      658           

Files with missing lines	Coverage Δ
src/review/content-lane/security-scan.ts	98.27% <100.00%> (+0.09%)	⬆️
src/review/secrets-scan.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.