fix(ci): stabilize detect-secrets baseline

src/gateway/connection-auth.test.ts

@@ -404,7 +404,7 @@ describe("resolveGatewayConnectionAuth", () => {
         config,
         env,
         includeLegacyEnv: false,
-        localPasswordPrecedence: "config-first",
+        localPasswordPrecedence: "config-first", // pragma: allowlist secret
       }),
     ).rejects.toThrow("gateway.auth.password");
     expect(() =>
@@ -412,7 +412,7 @@ describe("resolveGatewayConnectionAuth", () => {
         cfg: config,
         env,
         includeLegacyEnv: false,
-        localPasswordPrecedence: "config-first",
+        localPasswordPrecedence: "config-first", // pragma: allowlist secret
       }),
     ).toThrow("gateway.auth.password");
   });

src/gateway/credentials.ts

@@ -265,7 +265,7 @@ export function resolveGatewayCredentialsFromConfig(params: {
     }
     if (
       localPasswordRef &&
-      localPasswordPrecedence === "config-first" &&
+      localPasswordPrecedence === "config-first" && // pragma: allowlist secret
       !localPassword &&
       Boolean(envPassword) &&
       localPasswordCanWin