feat: version the credential detection corpus

[kev1n77]

Summary

• add a versioned shared credential corpus with 36 sensitive field names and 17 textual secret categories
• compile the Rust export scanner directly from the corpus instead of hardcoded patterns
• extend coverage for Basic auth, AWS, GitHub, GitLab, Hugging Face, Groq, xAI, Slack, npm, Stripe, and Databricks credentials
• validate every positive canary and near miss in Rust and the browser fallback
• verify Capture Policy and the Python sidecar scrub every shared sensitive field name with normalized variants
• mark SEC-002 complete while leaving SEC-001 log/temp-file canaries and independent security review open

Verification

• cargo fmt --all -- --check
• cargo fmt --manifest-path apps/desktop/src-tauri/Cargo.toml -- --check
• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml --all-targets
• cargo clippy --manifest-path apps/desktop/src-tauri/Cargo.toml --all-targets -- -D warnings
• npm run desktop:check (36 tests)
• npm run desktop:build
• python -m unittest discover -s sidecars/mitmproxy/tests -v (17 tests)
• python sidecars/mitmproxy/package_sidecar.py
• python sidecars/mitmproxy/verify_sidecar_bundle.py sidecars/mitmproxy/dist