Port missing secret-scan fixes to content-lane/security-scan.ts

[JSONbored]

Context

Part of the review-stack architecture audit (parent epic). Follows directly from the false-positive
investigation shipped in PR #4587 (which fixed isPlaceholderSecretValue across secrets-scan.ts,
content-lane/security-scan.ts, and REES's secret-scan.ts) — the duplication-dimension audit found
two additional, still-live drifts between content-lane/security-scan.ts and its two siblings that
predate and were not covered by #4587:

Finding 1 — missing placeholder carve-out → false-positive auto-close

secrets-scan.ts:72,94 and review-enrichment/.../secret-scan.ts:1048,1069 both check
LOWERCASE_HYPHENATED_MOCK_FIXTURE_PATTERN (/^(?:[a-z]+-)*mock(?:-[a-z]+)*$/) inside
isPlaceholderSecretValue. content-lane/security-scan.ts:83-88 does not — this carve-out was
added to secrets-scan.ts by commit 7d145f032 (2026-07-06, #3866) and never ported to the content-lane
copy. Since generic_secret_assignment is in content-lane/security-scan.ts's own HARD_SECRET_KINDS
(line 134-147) and this file's own header states "auto-close at high confidence, no human queue... a
false-positive close PERMANENTLY rejects a legitimate submission — the worst outcome," a fixture value
like token: "mock-response-value" is correctly ignored on the PR-diff path and by REES, but will
auto-close a content-lane (awesome-claude/metagraphed) submission.

Finding 2 — missing patterns → silent detection gap

content-lane/security-scan.ts's SECRET_PATTERNS list and HARD_SECRET_KINDS set (~lines 15-30,
134-147) are missing voyage_api_key and firecrawl_api_key, both present in secrets-scan.ts:32,34
since commit d409be4cee (2026-07-07, #3980, "hard-block Voyage and Firecrawl secrets"). A real
Voyage/Firecrawl key embedded in a content-lane submission currently produces no finding at all.

Fix

Port both changes into content-lane/security-scan.ts now, then follow up with the "extract shared
secret-detection module" issue (linked in the parent epic) so this class of drift can't recur a third
time.

Acceptance criteria

• content-lane/security-scan.ts correctly ignores mock-*/*-mock fixture values, matching the
  other two copies.
• voyage_api_key and firecrawl_api_key are detected by content-lane submissions.
• Regression tests for both, mirroring the existing secrets-scan.test.ts cases for the same
  patterns.

[linear-code]

JSO-3389