fix(scripts): extend forbidden-content.mjs with the repo's other known-precise secret formats

[claytonlin1110]

Summary

• FORBIDDEN_CONTENT (scripts/forbidden-content.mjs) — the packaged-secret detector used by check-miner-package.mjs, check-mcp-package.mjs, and miner-mcp-contract.test.ts — only matched 4 secret shapes, even though this repo already ships a materially larger, individually-verified-precise set of concrete secret-format patterns in src/review/secret-patterns.ts's SECRET_PATTERNS.
• Extended FORBIDDEN_CONTENT with the 12 additional formats from HARD_SECRET_KINDS (minus jwt): aws_access_key, slack_token, google_api_key, gitlab_token, npm_token, stripe_secret_key, sendgrid_key, huggingface_token, voyage_api_key, firecrawl_api_key, openai_api_key, anthropic_api_key — using the exact same regex bodies already defined for each.
• Approach taken: hand-copied the regex bodies into a single literal RegExp rather than importing from src/review/secret-patterns.ts. check-miner-package.mjs/check-mcp-package.mjs both run via plain node scripts/*.mjs (package.json's test:miner-pack/test:mcp-pack), and plain Node cannot resolve a .ts import (Unknown file extension ".ts", confirmed against this repo's Node 22 runtime) without a TS loader neither script registers — unlike scripts/check-engine-parity.ts, which runs via tsx. This is documented in a code comment on FORBIDDEN_CONTENT.
• jwt, seed_or_mnemonic, and bittensor_key were deliberately not added: jwt is out of scope for this issue (noted in the code comment), and seed_or_mnemonic/bittensor_key are documented in secret-patterns.ts as weak, false-positive-prone heuristics excluded from HARD_SECRET_KINDS there for the same reason (a coldkey:/hotkey = line or the word "mnemonic" in ordinary Bittensor docs is not a leaked credential).
• Zero changes to check-miner-package.mjs, check-mcp-package.mjs, or miner-mcp-contract.test.ts's call sites — this is purely a widening of what the shared constant matches.

Tests

• test/unit/forbidden-content.test.ts: added a parameterized case per new format (fixtures assembled from fragments, reusing the same fake bodies test/unit/secrets-scan.test.ts/test/unit/content-lane-security-scan.test.ts already use for these exact formats) plus a test pinning the 4 pre-existing formats as unchanged, and a test confirming jwt/seed_or_mnemonic/bittensor_key-shaped values are deliberately NOT matched.
• test/unit/miner-mcp-contract.test.ts: extended the existing secret-shape assertion with a newly-added shape (aws_access_key) to confirm the widening actually reaches that consumer.
• Verified no real-package false positive: scanned the actual packed @loopover/mcp/@loopover/miner file lists (via npm pack --dry-run --json) against all 12 new patterns directly — zero matches. The check-mcp-package.test.ts/check-miner-package.test.ts "passes on the real workspace package" tests fail identically on a clean pre-change baseline in this environment (npm pack failed — a pre-existing Windows spawnSync issue unrelated to this change), confirmed via a throwaway git worktree at the pre-change commit.

Validation

• npx vitest run test/unit/forbidden-content.test.ts test/unit/miner-mcp-contract.test.ts — 54/54 passing
• npx vitest run test/unit/secret-patterns.test.ts test/unit/secrets-scan.test.ts test/unit/content-lane-security-scan.test.ts — 169/169 passing (no regression in the sibling detectors this was copied from)
• npm run typecheck — clean (one pre-existing, unrelated error in packages/loopover-miner/lib/discover-cli.ts confirmed present on a clean main baseline too)
• npm run test:engine-parity && npm run test:live-gate-parity && npm run test:driver-parity — all passing
• npm run db:migrations:check && npm run db:schema-drift:check && npm run selfhost:env-reference:check && npm run miner:env-reference:check && npm run selfhost:validate-observability && npm run command-reference:check && npm run docs:drift-check && npm run manifest:drift-check — all clean
• npm run cf-typegen:check — no drift
• npm run actionlint — clean
• git diff --check — clean
• scripts/** and test/** are excluded from Codecov's coverage.include list per codecov.yml, so this PR carries no patch-coverage obligation — the tests above are real behavioral assertions per this issue's own "Test Coverage Requirements" section, not for gate purposes.

Closes #7433

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[JSONbored]

Merge conflicts/issue already resolved, closing.

This branch has conflicts that must be resolved
Use the [web editor](https://github.com/JSONbored/loopover/pull/7537/conflicts) or the command line to resolve conflicts before continuing.

scripts/forbidden-content.mjs
test/unit/forbidden-content.test.ts