fix(gitleaks): suppress Token routing false positive; sync allowlists; update roadmap

gitleaks false positive (U1, Gitea issue #2):
- 'Token routing: Haiku/Sonnet/Opus' in ai-coding-factory-session.md:90
  triggers generic-api-key on entropy match of "Token". Not a credential.
- ROADMAP.md now documents this pattern and triggers the same rule.
- Both .gitleaks.toml (deployed, read by hook) and scripts/gitleaks.toml
  (source for setup-gitleaks.sh deploys) updated and aligned. Previously
  out of sync — deployed file had docs/research/.* already; source did not.

ROADMAP.md: governance workstream Phase 2 expanded with 7 immediately-
actionable test suite gaps and 5 Chunk 6 CI gaps, all mapped to
CONTROLS.md requirements. Housekeeping updated with audit entry.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv5iNACZxumtF2k6TsK18q

scripts/gitleaks.toml

@@ -12,13 +12,13 @@ useDefault = true
 # Global allowlist — applies to all rules.
 # Note: uses [allowlist] (v8 syntax). v8.25.0+ uses [[allowlists]] (array of tables).
 # Add path regexes or stopwords to suppress known false positives.
-#
-# Example: ignore test fixtures
-# [allowlist]
-# description = "test fixtures"
-# paths = ['''tests/fixtures/.*''']
-#
-# Example: ignore a known false-positive secret value
-# [allowlist]
-# description = "placeholder values in docs"
-# stopwords = ["example", "placeholder", "changeme"]
+
+[allowlist]
+description = "Known false positives — prose patterns and research session notes"
+# docs/research/: high-entropy text from terminal captures in session notes
+# docs/ROADMAP.md: documents known false positives, triggering the same rules
+# ai-coding-factory-session.md:90 specifically: 'Token routing: Haiku/Sonnet/Opus'
+paths = [
+  '''docs/research/.*''',
+  '''docs/ROADMAP\.md''',
+]