ci: allow reviewed historical gitleaks fixtures

[sumitake]

Summary

• allow the five exact merge-commit fingerprints reported by the scheduled full-history Gitleaks scan
• keep suppression limited to reviewed synthetic fixtures and deterministic test digests
• extend the repository contract so all six approved fingerprints remain exact and no broad Gitleaks allowlist is introduced

Test plan

• python3 -m unittest discover -s tests -p 'test_*.py' passes (290 tests)
• Relevant updated contract test was observed failing before the allowlist change and passing afterward
• python3 scripts/check_repository_metadata.py passes
• python3 scripts/sanitize_public.py --tracked --history passes
• Gitleaks 8.24.3 full-history detection reports no leaks

PUBLIC-SAFETY checklist

• This PR contains no deployment identifiers (account IDs, zone IDs, tunnel IDs, installation/client/app IDs, or any other environment-specific identifier).
• This PR contains no secrets (tokens, keys, credentials, passwords, or anything secret-shaped), real or expired.
• This PR contains no real logs, real configuration, or real runtime state -- only synthetic examples.
• I ran python3 scripts/sanitize_public.py --tracked locally and it reported sanitization passed.
• I ran python3 scripts/check_repository_metadata.py locally and it exited 0.

Additional context

The failure was limited to the scheduled scan because that event scans merge history. Push and pull-request scans had already accepted the corresponding pre-merge fixture fingerprint.