security: scrub live credentials from tracked notes; point values at Vaultwarden

- replace real keys/passwords/tokens/connection strings with {{SECRET_*}}
  placeholders across 24 files (review-named 12 + noise-audit finds:
  WAQI/Dovecot/GPS/VPN subscriptions/Work runbooks/Plane API key)
- widen verifier: OPENSSH/RSA key headers, hyphenated sk-/prefixed sk-,
  credential assignments & table cells, telegram bot tokens, conn strings
- placeholder/default-value/config-name exemptions to kill doc FPs
- skip .obsidian plugin code and frozen Inbox-Clippings from value scan
- GIT_WORKFLOW: no git add ., verifier before commit, force-push exception
- final regression: 0 flagged in tracked scope (was 43)

01_Projects/AI-Development/Claw.md

@@ -148,18 +148,18 @@ WantedBy=multi-user.target
 telegram bot token
 windyclaw_bot
 ```
-8613374595:AAEZm_kCb_N9WDmRh5pXTBIZsKP_yI5vak8
+{{SECRET_TELEGRAM_WINDYCLAW_BOT}}
 ```
 
 
 ```
-curl -sS "https://api.telegram.org/bot8613374595:AAEZm_kCb_N9WDmRh5pXTBIZsKP_yI5vak8/getUpdates"
+curl -sS "https://api.telegram.org/bot{{SECRET_TELEGRAM_WINDYCLAW_BOT}}/getUpdates"
 ```
 
 
 ```
 [channels_config.telegram]
-bot_token = "8613374595:AAEZm_kCb_N9WDmRh5pXTBIZsKP_yI5vak8"
+bot_token = "{{SECRET_TELEGRAM_WINDYCLAW_BOT}}"
 allowed_users = ["203688083"]
 ```
 
@@ -176,7 +176,7 @@ smtp_port = 465
 smtp_tls = true
 
 username = "claw@windy.me"
-password = "F9h2INnnT$L4l9wQ"
+password = "{{SECRET_CLAW_EMAIL_CLAW_WINDY_ME}}"
 from_address = "claw@windy.me"
 
 poll_interval_secs = 60