Remove private/internal references from 2026-07-13

[boardwalk-bot]

Automated remediation from Boardwalk's daily private reference scan.

Summary: No critical or high-severity leaks found. The commits introduce public-facing functionality (org IDs in whoami/status, branded OAuth callback, workflow search) and include test data with generic placeholders. The only finding is a low-severity signal: test fixtures exposing demo org IDs (01ORGDEMO, 01ORGACME) and a mock API key (bwk_x), which are clearly non-real but should be generalized to avoid any perception of leaking internal ID formats.

Findings addressed:

• low src/commands/session.test.ts: orgId: "01ORGDEMO" — Replace "01ORGDEMO" with a generic placeholder like "demo-org-id" or "ORG_ID_PLACEHOLDER" to avoid exposing the internal ULID format.
• low src/commands/session.test.ts: token: "bwk_x" — Replace "bwk_x" with "TEST_TOKEN" or "mock_token_value" to avoid exposing the API key prefix format.
• low src/commands/status.test.ts: id: "01ORGDEMO" — Replace "01ORGDEMO" with "demo-org-id" or "ORG_ID_PLACEHOLDER".
• low src/commands/status.test.ts: id: "01ORGACME" — Replace "01ORGACME" with "acme-org-id" or "ORG_ID_PLACEHOLDER_2".

Please review carefully before merging. If any finding involved an actual credential, rotate it out-of-band.

[boardwalk-bot]

Automated review: looks good

The diff performs the claimed fixture-only remediation: mock API-key prefixes and demo organization IDs are replaced with generic placeholders, with corresponding assertions updated consistently. No correctness, security, test-coverage, or scope issues are evident in the provided changes.

Findings
No findings.

Posted by the Boardwalk PR reviewer (non-blocking).