fix(ci): allowlist the invented observer fixture session id for gitleaks

[JTP75]

The Secrets scan job is failing repo-wide, not on any one PR's diff. The job checks out with fetch-depth: 0 and runs gitleaks detect --source ., so it scans every reachable commit across all branches — not just the PR's changes.

Root cause: two generic-api-key findings, both the same invented passive-observer fixture session id (0f1e2d3c-4b5a-6978-8a9b-0c1d2e3f4a5b) asserted verbatim in crates/vettd-cli/src/observe/claude_code/discover_tests.rs and crates/vettd-cli/src/observe/extract_tests.rs. Those files exist only on the unmerged branch claude/vettd-cli-250-product-ready-tb6w2w; neither is an ancestor of main. The value is not a secret — it is the stem of a committed fixture transcript, and a real harness session id is HMAC'd into run_id. gitleaks reads assert_eq!(x, "<uuid>") as an assignment and the v4-shaped hex scores entropy 4.02. The allowlist that fixes this already exists on that branch but never landed on main, so every PR (and any main run) fails the same way.

Fix: one [[allowlists]] block in .gitleaks.toml, pinned to that single literal and scoped to the observe test paths, so any other high-entropy string in those files still fails. CI-only; no code or behavior change.

Verification: ran the version CI pins (gitleaks 8.30.1, matching the workflow's GL_VERSION) over the full history — 313 commits scanned, no leaks found, exit 0.

Note this unblocks #254 (whose Secrets scan is failing for this unrelated reason).