#3783 Registry scorecard: score secret-safe-docs (rubric v4) and keep sensitive on extracted arguments

Context

swamp-club#3757 adds a secret-unsafe-docs warning and a rubric v4 factor, secret-safe-docs (1 point), to the swamp CLI. The CLI ships first, so until this lands swamp extension quality shows one point more possible than the registry scorecard.

The detector is a pure module in swamp, src/domain/extensions/extension_secret_docs_detector.ts. #3781 tracks sharing the rubric as a package; until that exists, mirror it here by hand.

What the registry needs

1. Score secret-safe-docs at rubric v4. It is earned when no secret-unsafe-docs finding is left unaccepted. The scan covers:

   • the packaged Markdown, excluding include and data files
   • the manifest description
   • strings passed to .describe(...) or set as description: in source.

   Patterns:

   • vault reference syntax swamp does not support: vault://, <vault:, {{ vault without the leading dollar sign, and swamp vault set
   • --global-arg or --input that sets a secret argument to anything other than a vault expression. A secret argument is one the schema marks sensitive, or an undeclared name that reads as a secret. Boolean values pass.
   • swamp vault put with the value on the command line, unless the command uses --server or the value is a shell variable ($TOKEN or "${TOKEN}", not single-quoted)
   • full-length credential shapes. Repeated-character placeholders pass, as do user:pass@ URLs on localhost, loopback or example.com hosts.

   In Markdown, every pattern except credential shapes counts only inside fenced code blocks. Patterns are linear-time and lines over 2000 characters are skipped. The registry runs this on archives it did not author, so keep that property.

2. Honour accepted findings. contentMetadata.acceptances already carries file, rule and line. A finding accepted there does not cost the point.

3. Keep sensitive on extracted arguments. The CLI now sends sensitive: true on globalArguments, method arguments and vault/datastore configFields. validateModel in lib/domain/extension/extension-content.ts rebuilds each argument field by field and drops it. Keep it, and have the server-side extractor (lib/app/extract-extension-content.ts) set it from .meta({ sensitive: true }).

4. Bump RUBRIC_VERSION to 4 and add the factor to score.ts and analysis-factors.ts.

5. Update the manual: content/manual/reference/extensions/scorecard-rubric.md and content/manual/how-to/extensions/improve-score.md.

Impact

A scan of the latest version of all 1,909 registry extensions found at most 129 that would lose the point. That's an upper bound: the scan read no schemas, so declared non-secret names such as totalTokens were counted. Most hits are the patterns this issue targets.