fix(agentsmd-audit): scope secrets-scanner placeholder allowlist to matched token

validate-secrets.sh checked the placeholder allowlist regex against the
whole line before running any secret-pattern regex. An unrelated
placeholder-looking token anywhere on the line (e.g. "example" or
"your-token-here" in a trailing comment) suppressed detection of a real
credential earlier on the same line. Scope the allowlist check to the
matched secret-candidate substring only, which the per-match re-check
already did downstream but the whole-line pre-check short-circuited
before it ever ran.

Extend validate-secrets.bats with a case proving a real AWS-style key is
still caught when a placeholder token sits elsewhere on the line.
Regenerate the flat-mirror copy at
plugins/core/skills/agentsmd-audit/scripts/validate-secrets.sh via
scripts/sync-plugin-content.sh --all per ADR-0016.

plugins/core/skills/agentsmd-audit/scripts/validate-secrets.sh

@@ -87,14 +87,14 @@ for fpath in find_agents_md(repo_root):
     with open(fpath, encoding="utf-8", errors="replace") as f:
         lines = f.readlines()
     for i, line in enumerate(lines, start=1):
-        if PLACEHOLDER_RE.search(line):
-            continue
         for label, pattern in PATTERNS:
             m = pattern.search(line)
             if not m:
                 continue
-            # Re-check placeholder allowlist against just the matched value, in case
-            # the placeholder marker sits outside the regex's own match span.
+            # Scope the placeholder allowlist to the matched secret-candidate
+            # substring only. Checking the whole line would let an unrelated
+            # placeholder-looking token elsewhere on the line (e.g. in a
+            # trailing comment) suppress detection of a real credential.
             value = m.group(0)
             if PLACEHOLDER_RE.search(value):
                 continue