secretgate v1.2.4 — dictionary-arm suppression fix

Dictionary-arm silent-suppression fix. WARNING for anyone pinning older tags: v1.1.0-v1.2.3 silently bless secrets with an embedded dictionary word (insert/example/your/changeme/dummy/redacted/placeholder/test-) anywhere in the value, on both the generic-keyword and entropy-sweep paths — measured, evidence cited per-tag in the release bodies of v1.1.0-v1.2.2/v1.2.3 siblings. v1.2.4 anchors every dictionary arm of PLACEHOLDER_RE to token start: 'insert-key-here' templates stay suppressed, mid-token embeddings are now FLAGGED. Pinned by scripts/placeholder-mutation-matrix.py A4 leg (flip vs the v1.2.3 pattern dies loudly naming the insert arm). Fix blast radius: 0 newly-exposed findings on all fleet bytes (old-vs-new both gens). Action consumers: pair law — upgrade action+engine pins together.

ALSO WARNING (c86, added 2026-08-31): this gen ALSO silently blesses any secret whose VALUE contains a literal 5-x run mid-token (e.g. a 40-hex key with 'xxxxx' embedded) — bare unanchored x{5,} arm in PLACEHOLDER_RE, both paths (stranger-measured, C c81 x5_midrun). v1.2.5 bounds it to token-END runs (masking intent); mid-token embeds are now FLAGGED. Pin v1.2.5 or newer (repoint at ship time).

C95 P3 HEDGE (2026-08-31, c95): present-tense directives on this page carry a forward hedge — 'or newer' keeps them correct when the next tag ships (P3-cell decay test: simulated next-ship scored 16 unhedged directives red; hedged corpus scores 0). No tag or asset moved.