chore(gitleaks): allowlist install + npm-wrapper paths for .local XDG dirs

Tailscale-domain rule's regex was matching POSIX XDG user paths
($HOME/.local/bin) introduced by F003 npm wrapper PATH-persistence work.
These are filesystem paths, not mDNS/Tailscale hostnames.

Allowlist scoped to scripts/install.sh, npm/bin/*.js, and the related
smoke/unit tests; regexes pinned to recognized XDG path components.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 0xmariowu

.gitleaks.toml

@@ -35,6 +35,11 @@ keywords = [".ts.net", ".local"]
   paths = ['''skills/.*/SKILL\.md$''', '''docs/.*\.md$''']
   regexes = ['''\.local/''']
 
+  [[rules.allowlists]]
+  description = "Install scripts + npm wrapper + their tests reference $HOME/.local POSIX user dirs (XDG, not Tailscale .local hostname)"
+  paths = ['''scripts/install\.sh$''', '''npm/bin/.*\.js$''', '''tests/smoke/test_(npm_wrapper|install_script)\.py$''', '''tests/unit/test_install_sh_flags\.py$''']
+  regexes = ['''\.local/(bin|share|lib|var|state|cache|tmp)''', '''\$HOME/\.local''', '''process\.env\.HOME[^"]*\.local''']
+
 # ── Public-repo-only rules ───────────────────────────────────────────────────
 
 [[rules]]