Avoid false positive in production secret scan

[ryanbaumann]

What changed

• makes production smoke distinguish an OAuth schema field name from an assigned client-secret value
• preserves detection for value-shaped client_secret assignments, PEM private keys, and Stripe-style live keys
• adds regression coverage for allowed schema text, a short fixture, and a denied long value

Root cause

The public @google/genai browser bundle contains the OAuth schema identifier client_secret. Production smoke rejected that identifier alone even though no credential value was present. The local container smoke already required a value-shaped assignment.

Validation

• node --test scripts/test/smoke-production.test.mjs — 4 passed
• BASE_URL=https://fieldwork-gajikud3na-uw.a.run.app node scripts/smoke-production.mjs — all production checks passed, including served-asset secret scanning
• git diff --check — passed

No asset, dependency, or genuine secret-detection rule was excluded.