[create-croco-app] Enforce generated template secret placeholder and env redaction policy

[kang-heewon]

Problem

Generated templates include .env.example, provider profile docs, smoke commands, and provider configuration examples. These surfaces should use safe placeholders and should not accidentally introduce real-looking credentials or unsafe environment examples.

Desired outcome

Generated templates have a checked placeholder and redaction policy for environment variables and provider docs.

Acceptance criteria

• Define the placeholder format for generated .env.example files and provider docs.
• Scan generated templates for real-looking credential patterns.
• Verify secret-marked provider profile environment variables are documented with safe placeholders.
• Add allowlist support for intentional test fixtures with reason and owner.
• Include the scan in generated app smoke or package checks.