#1044 extension push 'credentials-sensitive-field' flags z.number() counts + type-aliases as secrets

Description

swamp extension push review warnings flag Zod fields as "looks like a secret … Sensitive values must be vaulted" based on the field name, ignoring the field type — so the rule credentials-sensitive-field fires on integer counts, literal constants, and schema/type declarations that cannot hold a secret value.

Steps to reproduce

Publish a model whose fields have token/credential/secret substrings in their names but are non-secret by type, e.g.:

• tokens: z.number().nullable() — a usage-token count
• secretShapedCount: z.number() — a count of tripwire detections
• credentialsScope: z.literal("deferred-to-capture") — a fixed marker string
• export const CredentialsSchema = z.object({ … }) — a schema / type alias

swamp extension push <manifest> --dry-run → 11 medium credentials-sensitive-field warnings, none real.

Expected vs actual

• Expected: flag only string-valued fields whose value could be a secret.
• Actual: name-only match → false positives on z.number() counts, z.literal() constants, and type/schema lines. On @vcjdeboer/session-ingest (a tool whose entire design is structural secret exclusion) this produced 11 false alarms — alarm fatigue that could mask a genuine hit.

Environment

swamp 20260708.202130.0-sha.3afd02a8; macOS arm64 (darwin 25.2.0)

Suggested fix

Gate the rule on the field's Zod type — skip z.number()/z.boolean()/z.literal()/type-alias/schema-definition lines; only flag string-typed fields.