ci: unblock TruffleHog secret scanning (Lob false positives)

[1kresh]

Why CI was red on #135

All four failing jobs were investigated. None were caused by product code.

Job	Result	Cause
Foundry project (non-fork)	✅ passed	—
Foundry mainnet forks	❌ 100 failures	dead ETH_RPC_URL
Foundry fork benchmarks	❌ 16 failures	dead ETH_RPC_URL
Foundry action script forks	❌ 2 failures	dead ETH_RPC_URL
TruffleHog	❌ exit 183	Lob false positives — fixed here

The fork jobs (not addressed by this PR)

All 118 failures are vm.createSelectFork errors, none are assertion failures. The endpoint is
dead at the TLS layer — with no token, method, or block involved:

$ curl https://fragrant-maximum-feather.ethereum-mainnet.quiknode.pro/
curl: (35) error:1404B438:SSL routines:ST_CONNECT:tlsv1 alert internal error

DNS resolves; the TLS handshake is rejected. No HTTP request is sent, so no test body executes.
This needs the ETH_RPC_URL repository secret rotated to a working archive provider that
serves MAINNET_FORK_BLOCK=25422678.

What this PR fixes

TruffleHog's Lob detector is \b((live|test)_[a-zA-Z0-9_]{35})\b with trigger keywords
live_ / test_. Foundry names every test test_..., so any test name that is exactly
test_ + 35 chars of [a-zA-Z0-9_] is byte-identical to a Lob sandbox key:

test_AddAdapterUsesAdapterWhitelistEntry
     └──────────── 35 chars ────────────┘

Reproduced locally with trufflehog 3.96.0 over CI's exact commit range (659 chunks /
1,285,193 bytes — identical scan scope): 56 findings, 25 unique, all in snapshots/gas.txt,
every one a test function name. With --exclude-detectors=lob: 0 findings.

CI runs trufflehog 3.96.0 even though the action is pinned to v3.90.5; v3.90.5 flags none of
these, so the regression arrived with the newer binary.

Why they were reported as verified

Worth flagging separately, because it is not Lob-specific. The detector's verifier treats
HTTP 403 as proof the key is live ("active but no billing method on file"):

case http.StatusForbidden, http.StatusUnprocessableEntity:
    return true, nil   // verified
case http.StatusUnauthorized:
    return false, nil

The bullfrog egress filter denied the call to api.lob.com, and TruffleHog recorded
"verified_secrets": 56. The most consistent reading is that the denial surfaced as a 403,
which the verifier cannot distinguish from a genuine live-key 403. Any detector using that
403-means-valid pattern can therefore produce false verified results whenever bullfrog blocks
its verification endpoint — so "verified" in this repo's CI should not be taken at face value
until the egress policy and the verification endpoints are reconciled. Excluding Lob fixes the
immediate failure but not that general behaviour.

A postal-mail API key cannot legitimately appear in this repository, so no coverage is lost.
--results=verified,unknown is deliberately retained.

Verification

• forge fmt --check — passes
• FOUNDRY_PROFILE=pr forge test --no-match-contract '.*(Mainnet|Benchmark).*' --no-match-path '...'
  — 1110 passed, 1 skipped, 0 failed (the skip is the lens deploy test, which correctly skips
  without ETH_RPC_URL, exactly as in CI)
• scan job on this PR: pass (was exit 183)
• Fork suites could not be reproduced locally: seven public RPC providers were probed and none
  serve archive state at block 25422678 without auth.

Still required for fully green CI

Rotate the ETH_RPC_URL secret in symbioticfi/core. That is a credential change and is out of
scope for this PR.

🤖 Generated with Claude Code