test(crypto): replace the one-file key scan with a repo-wide guard

crates/crypto/src/license_token.rs asserted, via include_str! on its own
file, that the license-token signing key is never checked in. The scan saw
exactly one file: the key moved anywhere else passed silently, and renaming
license_token.rs stopped the guard from compiling instead of reporting.

scripts/check_embedded_secrets.sh scans every tracked and not-yet-added text
file for the same needle plus the other private-key header forms and eleven
provider credential formats, and it does not skip the paths
.github/secret_scanning.yml tells push protection to ignore. Non-secret
matches are excused by exact literal, never by path glob, and an exemption
that stops matching is reported as stale. --self-test asserts every pattern
family fires.

scripts/README.md

@@ -28,6 +28,7 @@ their issue closes.
 | `check_architecture_migration_rules.sh` | ci-gate | Architecture-boundary anti-regression guard | ci.yml Quick Checks; `make pre-commit` |
 | `check_body_cache_whitelist.sh` | ci-gate | Keeps the app-layer body-cache eligibility gate fail-closed | ci.yml Quick Checks |
 | `check_doc_paths.sh` | ci-gate | Fails when instruction/architecture docs reference repo paths that no longer exist | `make pre-commit` / `pre-pr` |
+| `check_embedded_secrets.sh` | ci-gate | Repo-wide scan blocking committed private key material and provider credential literals | ci.yml Quick Checks; `make pre-commit` / `pre-pr` |
 | `check_extension_schema_boundaries.sh` | ci-gate | Extension-schema crate boundary guard | ci.yml Quick Checks; `make pre-commit` |
 | `check_layer_dependencies.sh` | ci-gate | Crate-layering DAG guard (reads `layer-dependency-baseline.txt`) | ci.yml Quick Checks |
 | `check_logging_guardrails.sh` | ci-gate | Blocks legacy logging patterns from returning | `make pre-commit` / `pre-pr` |