fix(ci): allowlist dummy test key in gitleaks scan

The dummy value `sk-secret-key-1234567890` in test/tools.test.ts trips
gitleaks' default `generic-api-key` rule (entropy 4.02) and fails the
Secret Scan CI job on PR #1. This is a test-only fixture explicitly
endorsed by AGENTS.md ("Tests use dummy values ... sk-secret-key-…"),
not a real key — the value is also asserted by the redaction test at
line 183, so it cannot be changed.

Suppress the single line with a `gitleaks:allow` inline comment rather
than weakening the rule set globally. Verified locally with gitleaks
8.24.3 (matching CI): test/ scans clean, .env (gitignored, real key)
is the only remaining finding and is not tracked.

Author: sommio

test/tools.test.ts

@@ -8,7 +8,7 @@ import { type AppConfig } from "../src/config.js";
 import { DEFAULT_COMPARE_PROMPT } from "../src/prompts.js";
 import { createServer } from "../src/server.js";
 
-const SECRET_KEY = "sk-secret-key-1234567890";
+const SECRET_KEY = "sk-secret-key-1234567890"; // gitleaks:allow — dummy test fixture, not a real key
 const cfg: AppConfig = {
   apiKey: SECRET_KEY,
   model: "qwen3.7-plus",