Merge origin/main into redact-2

Resolve against main's scanner-selection and OPF-deprecation work: keep the shell-stdin layer as detection pass 7 alongside goredact, add the tool-use-id entropy exemption next to the identifier guard, renumber the security doc's pass counts from main's text, and restore isPlaceholderSecretValue as the quote-agnostic wrapper that main's scanner callers use.