sec (9/9): document that scanners must not print secrets into raw evidence

[jesse-merhi]

What changes

Documentation only. Adds a note to docs/scanners.md telling user-defined
scanner authors not to print secrets into their JSON evidence, and corrects
the scanner-id field description to match the validation added earlier in the
series (lowercase, ≤64 chars).

Why it matters (finding 9)

The hardening series found nine issues. Eight are code fixes (#25–#32). The
ninth is not something ClawScan can fix in code without breaking its core
contract:

• ClawScan preserves a scanner's stdout verbatim as raw evidence — that
  rawness is the point (auditable, unmodified scanner output).
• If a scanner prints its own API key into that JSON, ClawScan stores it as-is.
• ClawScan already redacts declared env values from scanner error text
  (sec (7/9): redact declared scanner env values from error text #31), but redacting inside raw evidence would corrupt the evidence.

So finding 9 is the scanner author's contract, documented here rather than
enforced in code. This was an explicit decision, not an oversight.

The note

Do not print secrets into evidence. Because ClawScan stores the scanner's
stdout verbatim as raw evidence, any secret the scanner writes into its own
JSON output is persisted as-is. ClawScan redacts declared env values from
scanner error text, but it cannot redact inside raw evidence without
corrupting it. A user-defined scanner must not echo its API keys, tokens, or
other credentials into the JSON report it emits.

Scope

sec 9 of 9; stacked on #32. Docs source only — generated dist/docs-site is
left to the release step per repo policy. Merge order:
main → #23 → #24 → #25 … #32 → this.

Verification

Prose + one table cell. No code paths touched; go build/test unaffected.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: sec (9/9): document that scanners must not print secrets into raw evidence This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.