fix(ci): secret-scanner remediation text no longer cites the leak site

[hyperpolymath]

Closes #800.

The defect (re-measured at HEAD 33ec4a7, 2026-09-17)

The shell-secrets job's remediation message read:

Source from env (see avow-protocol/deploy-repos.sh) instead.

That citation fails twice, in the issue's words:

1. It cites the leak site as the model of good practice. The same file identifies avow-protocol/deploy-repos.sh as the failure case this gate was created for — twice, in comments (L17-19, L671).
2. It 404s. avow-protocol/deploy-repos.sh was removed by security(avow-protocol): remove leaked Cloudflare API token + harden scanner #161; avow-protocol/ now holds only BINDING.adoc. The guidance cannot be followed even in principle.

Fix (the issue's own suggested text)

echo "::error::Hardcoded secret detected in a shell script. Read the value from the environment (e.g. "\${MY_TOKEN:?}") and supply it via a repo or org secret."

The citation is dropped rather than repointed — any named example can rot the same way, and the advice needs no example to be actionable. The two comments documenting the leak's history are untouched: they are accurate records of why the gate exists.

Byte-verified: the line is "/\$-escaped correctly for bash (single backslashes; od -c checked). One file, +1/-1.

[coderabbitai]

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}