Add secret tripwire: sp scan + ls marker + promote guard (#9)

[rwrife]

Closes #9

Adds the secret tripwire: scratchpatch now warns when a scratch looks like it holds a credential and refuses to promote it into a repo without an explicit override.

What's in it

• internal/secret package — a pure, dependency-free heuristic detector with fixture-driven unit tests. Catches:
  • AWS access key ids (AKIA…/ASIA… + fixed-length tail)
  • PEM private-key headers (-----BEGIN … PRIVATE KEY-----)
  • secret-looking assignments (API_KEY=, TOKEN=, SECRET=, PASSWORD=, …) with a non-placeholder value
  • long, high-entropy, generated-looking tokens (bearer tokens, opaque keys)
  • Conservative by design to dodge alarm fatigue: template values (changeme, <your-token>, ${VAR}), prose, long numbers, and URLs stay quiet.
• sp scan <id> — reports findings by line number with values masked (never echoes a full secret). Non-zero exit when secrets are found, so it slots into pre-commit hooks / CI. --json and --no-color supported.
• sp promote block — refuses a tripped scratch unless --allow-secrets is passed. Checked before any move, so a blocked promote changes nothing.
• sp ls marker — a 🔑 next to any scratch that trips; sp ls --json sets "secret": true.
• README updated (Quickstart, "What works today", new sp scan section, sp promote --allow-secrets).

Acceptance criteria

• Heuristic scan for common secret shapes (AWS keys, *_API_KEY=, private-key headers, high-entropy tokens)
• sp ls flags scratches that tripped the detector (🔑 marker)
• sp promote blocks on a tripped scratch unless --allow-secrets
• sp scan <id> reports findings with line numbers (no secret values echoed in full)
• Detector lives in its own package with unit tests over fixture files

Notes

• Values are masked everywhere (first-3…last-3, or fully starred when short); no raw secret is ever printed or stored in a Finding.
• Follows the repo's layering: internal/secret returns plain data, render owns presentation/color, the marker rides as a side map so the store/index stay unaware of the tripwire.
• Fixtures deliberately use synthetic tokens (no live-provider prefixes) so the repo's own push protection stays happy — fitting, given the feature.
• go build / go vet / gofmt / go test ./... all green.

What's left for a follow-up: --json on the detector is per-scratch via sp scan; a bulk sp scan --all could be a nice future addition.