fix(gitleaks): suppress Token routing false positive; sync allowlists; update roadmap

gitleaks false positive (U1, Gitea issue #2):
- 'Token routing: Haiku/Sonnet/Opus' in ai-coding-factory-session.md:90
  triggers generic-api-key on entropy match of "Token". Not a credential.
- ROADMAP.md now documents this pattern and triggers the same rule.
- Both .gitleaks.toml (deployed, read by hook) and scripts/gitleaks.toml
  (source for setup-gitleaks.sh deploys) updated and aligned. Previously
  out of sync — deployed file had docs/research/.* already; source did not.

ROADMAP.md: governance workstream Phase 2 expanded with 7 immediately-
actionable test suite gaps and 5 Chunk 6 CI gaps, all mapped to
CONTROLS.md requirements. Housekeeping updated with audit entry.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv5iNACZxumtF2k6TsK18q

.gitleaks.toml

@@ -23,5 +23,11 @@ useDefault = true
 # stopwords = ["example", "placeholder", "changeme"]
 
 [allowlist]
-description = "research session notes — no secrets, high-entropy text from terminal captures"
-paths = ['''docs/research/.*''']
+description = "Known false positives — prose patterns and research session notes"
+# docs/research/: high-entropy text from terminal captures in session notes
+# docs/ROADMAP.md: documents known false positives, triggering the same rules
+# ai-coding-factory-session.md:90 specifically: 'Token routing: Haiku/Sonnet/Opus'
+paths = [
+  '''docs/research/.*''',
+  '''docs/ROADMAP\.md''',
+]