chore(gitleaks): allowlist commit 96bd383 (P2-8 test fixtures)

gitleaks-action scans the full PR diff range, so even after inline
//gitleaks:allow comments were added to aead_test.go in commit 5477bd8,
the historical commit 96bd383 (where the fixtures were introduced)
continues to trip the generic-api-key rule.

Adding the commit SHA to the existing allowlist (same pattern used for
2fdb5ba). The fixtures themselves are deterministic 64-hex-char values
used to exercise the encryption-at-rest round-trip — not real secrets.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sarg3nt

.gitleaks.toml

@@ -73,8 +73,13 @@ regexes = [
 # Allowlist - commits to ignore
 # 2fdb5ba: functional_test.go had an example API key value in a doc comment
 # (test-only, not a real credential — replaced with <YOUR_API_KEY> placeholder in a later commit)
+# 96bd383: aead_test.go added three 64-hex-char fixtures (plainSecret /
+# apiKey) to exercise the encryption-at-rest round-trip. A later commit
+# added inline //gitleaks:allow comments, but the gitleaks-action scans
+# the full PR diff range so the historical commit still trips the rule.
 commits = [
     "2fdb5ba0d2e8da23a6409527cdbf6696d90eb537",
+    "96bd38365b022aa8b9d78886dfd3eb16e644eecf",
 ]
 
 # Stopwords - tokens that if found will stop gitleaks