fix(governance): eliminate false secret matches and preserve UNVERIFIED settings

[Yesol-Pilot]

Problem

The previous reusable gate produced two incorrect classifications.

1. Ordinary identifiers containing an internal sk- substring were reported as OpenAI credentials. Evidence: NeoGenesisAI/neomux-desktop Repository Governance run 33065815737 reported 105 candidate paths dominated by task-*, risk-*, desk-*, and mask-* identifiers.
2. REST fields unavailable to the workflow token were rendered as policy mismatches rather than an explicit unreadable state. Evidence: the same run returned null setting fields while the connected administrator readback returned concrete booleans.

Change

• require credential-prefix boundaries and provider-specific key shapes;
• exercise synthetic positive and natural-language negative detector cases;
• remove broad line-level EXAMPLE or DUMMY suppression;
• read merge policy through GitHub GraphQL Repository fields;
• preserve UNVERIFIED when a setting cannot be read;
• keep confirmed boolean mismatches fail-closed;
• report path and rule without printing candidate values;
• skip duplicate secret reports inside an already-prohibited generated tree;
• add a same-revision reusable-workflow self-test caller.

Safety boundary

This PR does not approve a credential, add a path allowlist, mutate caller repositories, waive a confirmed setting mismatch, or claim that Einstein repository settings comply with policy.

Verification evidence

• Evidence: Repository Governance Validator Self-test run 33080315044 completed successfully on exact head 32c3a5bf523efa4d0f727667ee0f4608a93aa7eb.
• Evidence: CI run 33080314843 completed the Python 3.9/3.12/3.13 Linux and Windows jobs plus distribution inspection successfully; its only failing job was the PR-description dogfood gate that requested this evidence note.
• Evidence: Repository Governance run 33080315168 on the same head reported zero credential-pattern findings and five concrete repository-setting mismatches: auto-merge disabled, merge commits enabled, rebase enabled, branch update disabled, and merged-branch deletion disabled.

The settings findings remain failing states and require a repository-administrator mutation; they are not waived by this validator repair.