[remigiusz-antczak]

This adds rules for the held-out misses from #1988 that generalize, and scores them on a second blind corpus that was frozen before the rules were written.

Rule changes:

• .banlist.txt: provider token formats.
• destructive_guard.py: cloud, Kubernetes, Terraform, NoSQL, disk-tool and base64-eval rules.

Results on the second held-out corpus (docs/bench/security-gates-heldout2-1024/). The corpus was preregistered in 8abdefc93 before these rules existed, and no rule changed after scoring:

Gate	Perun	Rivals (ported rules)
Secret leaks found (40) / decoys flagged (40)	23 / 2	gitleaks v8.30.1: 26 / 0
Dangerous commands blocked (50) / benign blocked (50)	37 / 4	claude-code-safety-net subset: 18 / 2; hooks-mastery: 9 / 5

• Out of sample, Perun still trails gitleaks on secrets (23 against 26). Combining the two would miss only 7 of 40. The next change adds the gitleaks rules to Perun's secret gate and scores the combination on a third preregistered corpus.
• Perun leads on destructive commands (37 against 18 and 9). The remaining misses are listed in RESULTS.md as leads for a later rule wave, scored on a fresh corpus. They are: bare SQL, redirects into system files, git filter-branch, some cloud and Helm deletes, printf-hex and eval $(echo …) obfuscation, redis-cli reading FLUSHALL from stdin, and aws s3 sync --delete.
• The first held-out corpus is now in-sample. Its 30/30 and 40/40 are labelled that way, and docs/perun-vs-rivals.md keeps its blind numbers as "as scored blind". The original corpus is unchanged.

Tooling:

• score.py accepts id-prefixed rows and checks hashes against SHA256-frozen.txt.
• bench_check.py resolves a bare frozen filename from the bench directory first.
• The privacy gate skips exactly four frozen corpus files by exact repo-relative path. A test shows that a key placed in any other security-gates-* file still fails.

The independent review found 2 🔴, both fixed, and a re-review checked the fixes:

• The first version of the privacy skip used a glob that crossed directories.
• The base64-eval rule, and the command-substitution scan under it, could be driven into polynomial and exponential backtracking. The fix is linear, and a regression test enforces a time bound.

Four 🟡 were also folded in: a kubectl delete -n <ns> ns <name> bypass, the in-sample row label, the freeze-order wording, and the known gaps. Re-scoring after these fixes gives identical numbers.

GitHub push protection blocked one placeholder decoy key, row D2-08. Its @@ marker is recorded as an amendment in ledger.jsonl and SHA256-frozen.txt. The pin test checks that the first five lines still hash to the preregistered value, and the @@-stripped content and every score are unchanged.

Local CI repro:

• Security tests, size-ratchet and privacy are green.
• test-ci-gates.sh gives 297 passed and 9 failed. The same 9 fail on the parent commit (sandbox ps and network). main had 11 failures before.

🤖 Generated with Claude Code

https://claude.ai/code/session_014QNFFPWVcPUbeuvwM5fk2Z