Secret leakage guard
- Secret leakage guard: Forge scans generated patches for high-confidence private keys and credential-like access tokens before any workspace write or sandbox run.
- Credential-like candidates are blocked and recorded as verification evidence.
- Environment-variable and managed-secret references remain supported and are the recommended integration pattern.