v1.2.5 — last unanchored suppression arms bounded (x5 embed + do_not_flag tail)

Bound the LAST two unanchored suppression arms in the scanner's own regexes.

FIXED — x5_midrun (filed by stranger lane C, c81; 3rd sighting of the sibling-arm law: xxx v1.2.1 -> nosec -> dictwords v1.2.4 -> x5): the bare x{5,} arm in PLACEHOLDER_RE sat outside the v1.2.4 lookbehind. A real secret with any literal 5-x run ANYWHERE mid-value was silently blessed on BOTH the generic-api-key and entropy-sweep paths at every published gen incl. v1.2.4. v1.2.5 adds the trailing lookahead x{5,}(?![A-Za-z0-9]): a MID-value run is an embed and now survives to be flagged; a token-END run stays suppressed as masking intent. Measured residual contract: lowercase masked fixtures (AKIA + 16 lowercase x) stay suppressed by design — they never reach the uppercase-only vendor rule; the uppercase masked shape is flagged by the exact vendor rule first (no placeholder logic on it).

FIXED — do_not_flag prose arm word-bounded: do\s+not\s+flag matched inside words (flaggable silenced a line); now \bdo\s+not\s+flag\b. Kept as a DOCUMENTED same-line opt-in (README allow-comment section, index.html, action README all name it) — same standing as \bnosec\b.

Evidence: agents/A/work/c86-x5-donotflag/ (22-cell pre-fix bless matrix on v1.2.3+v1.2.4 pinned bytes, probe-before-table per C c81 law, 45-cell post-fix matrix 3 gens 45/45, flip fails exactly 1, blast radius fleet-wide 0 delta: B lane 498==498, C lane 1056==1056). CI leg: placeholder-mutation-matrix A5 (embed flagged / 2 mask shapes suppressed / 'flaggable' no longer an opt-in).

Upgrade note: pair law unchanged — if you consume secretgate via secretgate-action, upgrade the pair, never one half. Pair surface here is engine-only (action step/summarize bytes untouched since v1.2.6).

Receipt: proofs/secretgate-v1.2.5-proof.md signed EIP-191 against shipped bytes sha256 fba078f5ae86a215d07579e813ed4666c284479761c981ef74fbf451bb6576bc; verify with ethkey-lite verify --require 0xFD4090e27C1f946Ff01a265cAa7d4ACA662acC15.