fix(scripts): forbidden-content.ts's hand-copied secret-pattern regex has zero drift protection against its canonical source

[JSONbored]

⚠️ Definition of Done: this issue must be completed in full, in a single PR. Do not split this
work across multiple PRs, and do not defer any Deliverable below to a follow-up issue. A PR that
satisfies only some of the Deliverables, stubs a required test, or leaves a checkbox
partially-done does NOT resolve this issue and will be closed.

Context

scripts/forbidden-content.ts:1-41 builds FORBIDDEN_CONTENT as a hand-copied regex set, with its
own header stating (lines 8-17) it was "hand-copied (#7433) from the exact regex bodies of the
entries in src/review/secret-patterns.ts's SECRET_PATTERNS ... NOT imported directly."

src/review/secret-patterns.ts:1-14's own header explicitly documents that its OTHER known
hand-duplicate — review-enrichment/src/analyzers/secret-scan.ts (REES) — "is drift-checked
mechanically — see scripts/check-engine-parity.ts's SECRET_DETECTION_TWIN_PAIR" (confirmed at
scripts/check-engine-parity.ts:101-134, registered in NAMED_TWIN_PAIRS at line 150). But
NAMED_TWIN_PAIRS (lines 145-151) never references scripts/forbidden-content.ts at all — this is a
third, entirely unprotected hand-copy of the same security-critical HARD_SECRET_KINDS regex set,
consumed by all four package-manifest checkers (check-mcp-package.ts, check-miner-package.ts,
check-engine-package.ts, check-ui-kit-package.ts), with no marker-presence check and no byte-diff
against the canonical source. test/unit/forbidden-content.test.ts only asserts hardcoded example
probes match the local copy — it never compares against secret-patterns.ts's live source.

secret-patterns.ts's own header already documents that this exact class of hand-duplication
"already caused two independent, currently-live drifts ... despite a same-day commit editing both
copies." The fix mechanism (NAMED_TWIN_PAIRS) already exists and is applied to the REES copy —
just never extended to forbidden-content.ts. A future edit to a HARD_SECRET_KINDS regex (e.g.
tightening sendgrid_key, or adding a new provider kind) would silently leave packaged MCP/miner/
engine/ui-kit tarballs scanning with a stale pattern, with no CI signal at all.

Requirements

• Add scripts/forbidden-content.ts as a new NamedTwinPair entry in
  scripts/check-engine-parity.ts's NAMED_TWIN_PAIRS, with hostRelative pointing at
  src/review/secret-patterns.ts and engineRelative (or the equivalent field name) pointing at
  scripts/forbidden-content.ts.
• Define a marker set covering each HARD_SECRET_KINDS regex-body literal, directly analogous to
  the existing SECRET_DETECTION_MARKERS used for the REES twin pair.

Deliverables

• scripts/forbidden-content.ts is registered as a new twin pair in
  check-engine-parity.ts's NAMED_TWIN_PAIRS.
• A marker set for HARD_SECRET_KINDS is defined and checked for forbidden-content.ts,
  mirroring SECRET_DETECTION_MARKERS's existing shape exactly.
• A new test proves the marker-presence check fails when a HARD_SECRET_KINDS regex body in
  secret-patterns.ts is edited without a matching update to forbidden-content.ts — mirroring
  the existing test at test/unit/check-engine-parity-script.test.ts:448 ("fails presence when
  the shared isPlaceholderSecretValue algorithm drifts on one side").
• The real current repo state (both files as they exist today) passes the new drift check
  cleanly, proving the marker set is correctly calibrated against the live source, not just a
  synthetic fixture.

All four Deliverables are required in the same PR.

Test Coverage Requirements

scripts/** and its test suite are measured by codecov/patch (99%+ target, branch-counted). The
new test must exercise the drift-detection failure path directly (an injected divergence between the
two files), not just the passing case.

Expected Outcome

A future edit to any HARD_SECRET_KINDS regex in the canonical secret-patterns.ts that isn't
mirrored into forbidden-content.ts is caught by CI immediately, closing the third and last
unprotected hand-duplicate of this security-critical pattern set.

Links & Resources

• scripts/forbidden-content.ts:1-41 (the unprotected hand-copy)
• src/review/secret-patterns.ts:1-14 (the canonical source, SECRET_PATTERNS,
  HARD_SECRET_KINDS)
• scripts/check-engine-parity.ts:101-134,145-151 (SECRET_DETECTION_TWIN_PAIR,
  NAMED_TWIN_PAIRS, the already-existing fix mechanism to extend)
• test/unit/check-engine-parity-script.test.ts:448 (the test pattern to mirror)
• Introduced by fix(scripts): extend the packaged-secret detector (forbidden-content.mjs) with the repo's other known-precise secret formats #7433

[linear-code]

JSO-6020