Refuse thin secret filenames and token shapes

[jmjava]

Summary

• Q-SLM-20 leftover Add layered evaluation protocol, harness, and premium apply gate #6: inspect_payload now refuses id_ed25519, .aws/credentials, kubeconfig, plain sk-, AKIA, JWT-shaped blobs, and spaced aws_secret_access_key =.
• Proving test: test_inspect_payload_refuses_thin_secret_shapes parametrizes those fixtures; each case must return a reason.
• Leftover Add Halo host profile, C4 diagrams, and public roadmap #5 (MAX_BYTES character vs byte count) is untouched. No A8/A9 or Halo 4 work.

Test plan

• PYTHONPATH=src .venv/bin/python -m unittest tests.test_payload.InspectPayloadTests.test_inspect_payload_refuses_thin_secret_shapes -v
• PYTHONPATH=src .venv/bin/python -m unittest tests.test_payload tests.test_server_payload tests.test_eval_orchestrate -v
• CI unit job on this PR

Made with Cursor