feat(FN-4915): complete Step 1 — extend secret audit taxonomy

Fusion-Task-Id: FN-4915
Fusion-Task-Lineage: d5c49dae-6069-4998-b632-aca52cc312dc

packages/engine/src/__tests__/run-audit-secret-taxonomy.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, it } from "vitest";
+import {
+  SECRET_AUDIT_PLAINTEXT_FORBIDDEN_KEYS,
+  SECRET_MUTATION_TYPES,
+  assertNoSecretPlaintext,
+  type FilesystemMutationType,
+} from "../run-audit.js";
+
+describe("run-audit secret taxonomy", () => {
+  it("keeps secret mutation types assignable to FilesystemMutationType", () => {
+    const _check: readonly FilesystemMutationType[] = SECRET_MUTATION_TYPES;
+    expect(_check).toHaveLength(13);
+  });
+
+  it("throws when forbidden plaintext-like keys are present", () => {
+    for (const key of SECRET_AUDIT_PLAINTEXT_FORBIDDEN_KEYS) {
+      expect(() => assertNoSecretPlaintext({ [key]: "x" })).toThrow(
+        "secret audit metadata may not include plaintext fields",
+      );
+    }
+  });
+
+  it("accepts benign metadata", () => {
+    expect(() => assertNoSecretPlaintext({ key: "API_KEY", scope: "project" })).not.toThrow();
+    expect(() => assertNoSecretPlaintext(undefined)).not.toThrow();
+  });
+});