docs(playbook): keyword grep is blind to unlabeled entropy — the reliable check is your own minted values

A bare 32-hex key id matches none of the six credential keywords (verified). Added
an entropy scan and a PEM check as generic complements, marked the prefix list
repo-specific, and made the primary rule explicit: a gate that mints anything must
grep the commit for the literal values it produced.

admin_ui_cleanup.md

@@ -405,10 +405,25 @@ the only point at which it is cheap.
    that is supposed to be there. So run both:
 
    ```bash
-   git diff --name-only <base>..<sha>                 # wrong-file
+   git diff --name-only <base>..<sha>                 # (a) wrong-file
    git show <base>..<sha> | grep -inE '(api[_-]?key|password|secret|token|bearer|connectionstring)[\"'"'"' :=]+[A-Za-z0-9+/_-]{12,}'
+   git show <base>..<sha> | grep '^+' \
+     | grep -oE '[A-Fa-f0-9]{24,}|[A-Za-z0-9+/]{32,}={0,2}' | grep -v /   # (c) unlabeled entropy
+   git show <base>..<sha> | grep -c 'BEGIN [A-Z ]*PRIVATE KEY\|BEGIN CERTIFICATE'
    ```
 
+   **(b) is keyword-anchored and therefore blind to unlabeled material** — a minted key id like a bare
+   32-hex string has no keyword near it and will not match; verified. Hence (c), and hence the PEM
+   check, since `-----BEGIN` is labeled but by none of those six words. The prefix list is also
+   **repo-specific and goes stale** (`otua_` is OtOpcUa's, `histgw_` HistorianGateway's) — extend it
+   per repo rather than treating the line as fixed.
+
+   **The reliable check is none of the above: if your verification gate MINTED anything — an API key,
+   a token, a test account — grep the commit for the literal values it produced.** Generic patterns
+   are a net for what you did not anticipate; the literal grep is the check for what you *did*, and
+   only it is dependable, because you know the exact string and nobody else does. A clean generic scan
+   is weak evidence when a gate minted credentials that the scan structurally cannot see.
+
    Verified 2026-08-11 across this family: **`.claude/` is gitignored in OtOpcUa (`.gitignore:32`) and
    HistorianGateway (`.gitignore:51`), but NOT in MxAccessGateway or ScadaBridge.** In those two the
    enumerate-first discipline is the *only* thing between a "commit the sweep" instruction and local