fix(rules): close secret-detection edge cases (#625, #628, #629, #630)

[ajianaz]

What

• fix(rules): Java new String("literal") and other constructor wrappers are not flagged #630: a string literal inside a recognised constructor wrapper (new String, String::from, Some, Secret::new/from, Cow::Owned/Borrowed, Box/Arc/Rc::from, Python str/bytes) counts as a literal; the scanner regex also matches short-callee constructors. Plain calls stay quiet.
• fix(rules): a real literal default inside an env-read expression is not flagged #628: in code files, a literal in the DEFAULT position of an env read is flagged (Python os.environ.get/os.getenv, JS process.env.X || / ??, Rust env::var(..).unwrap_or(..)/unwrap_or_else, Ruby ENV.fetch, PHP getenv() ?:). The env var name is never inspected; empty and ${..} defaults stay quiet.
• fix(rules): shell default literal inside interpolation is not flagged #629: shell ${VAR:-literal} / ${VAR:=literal} with a secret-looking default is flagged (also quoted, and in YAML values); ${VAR}, ${VAR:-}, ${VAR:?msg}, nested references, paths, URLs and bare keywords stay quiet.
• fix(rules): YAML plain-scalar secret rule is too broad/narrow in edge cases #625: (1) the unquoted-YAML scalar rule no longer applies to source code; (2) YAML flow-style { password: hunter2hunter2 } is flagged (.yaml/.yml only); (3) unspaced password:=os.Getenv("X") no longer matches via [=:]; (4) SQL PASSWORD "..." / IDENTIFIED BY "..." detected, with placeholder suppression kept.
• The LLM cross-check (has_secret_literal) uses the same classifiers.

Why

Closes the false negatives and false positives pinned as KNOWN_GAPS rows after #621/#627. The all-alphabetic YAML value (password: correcthorsebattery) cannot be told apart from references (secret: kubernetes) without a classifier, so it stays a KNOWN_GAP, tracked in #635.

Testing

• Table tests: KNOWN_GAPS rows for fix(rules): a real literal default inside an env-read expression is not flagged #628/fix(rules): shell default literal inside interpolation is not flagged #629/fix(rules): Java new String("literal") and other constructor wrappers are not flagged #630 moved to CASES, secret: Secret1Type flipped to unflagged, about 70 positive and negative rows added; one KNOWN_GAPS row remains (fix(rules): all-alphabetic unquoted YAML secret (password: correcthorsebattery) is not flagged #635).
• cargo fmt, cargo clippy --all-targets -- -D warnings, full cargo test 3x green.
• Real binary in a temp git repo: one-line sample per shape, positives flagged and negatives quiet via cora review --staged --format compact.

Closes #628
Closes #629
Closes #630
Refs #625

🤖 Generated with Claude Code