[zhongerdeajie]

Closes #51.

Root cause. A key pasted into an ordinary file left with the source previews, for two
independent reasons:

1. the name policy (isSensitive) matched only .env and .env.*, so prod.env and
   keys.env were eligible;
2. the content scan in readSnapshot caught only a -----BEGIN ... PRIVATE KEY----- block,
   so a token pasted into settings.json / config.toml / keys.json went out on every
   request — API keys in ordinary config files are sent to the provider #51 measured 12 of 29 requests carrying one fake value — while never appearing
   in the printed context, so the calling agent had no way to notice.

Fix. Both gaps closed in the place the policy already owns, cheapest first as the issue
proposes:

• isSensitive treats names ending in .env like .env and .env.* (same
  sensitive_name reason, same includeSensitive override);
• readSnapshot's content scan also refuses a provider token shape — sk-, sk_live_,
  ghp_, github_pat_, glpat-, xox[abpr]-, AKIA + 16, AIza + 35, each with a
  minimum length past its prefix so prose and identifiers do not trip it — as a new
  api_key reason, behind the same !policy.includeSensitive gate as the private-key
  check, so the existing override admits it unchanged.

Not a guarantee. README's own words stand: the filters narrow what a search sends, they
do not promise secrets are caught. This only closes the specific gap the issue measured.

Tests (packages/core/test/filesystem.test.ts, written first, red/green):

• prod.env / keys.env → excluded as sensitive_name;
• one fake token per shape in an ordinary file (settings.json, config.toml, keys.json,
  aws.txt, slack.ts, gitlab.txt, github.txt) → excluded as api_key;
• near-miss prose (sk- alone, AKIA12345) stays eligible;
• includeSensitive: true admits all of the above, as before for the private-key case.

The fixture tokens are assembled by string concatenation inside the test so the literal
credential shapes never appear verbatim in committed source (secret scanners match raw
text); the values the assertions exercise are unchanged.

[dzhng]

Closing this PR because its changes overlap the consolidated secret-filter work in #53 and #59. The review found false positives from unbounded sk- matching and duplicated suffix-policy logic; those fixes will be carried forward in the consolidated successor.