docs: describe credential shapes instead of quoting one

The test-secret rule warned against JWT-shaped fixtures and then included a
real JWT header segment as its example. Secret scanning tolerates it today,
but it is a latent trip-wire in the one document explaining how expensive that
trip-wire is to clear - and a rule that violates itself reads as permission.

Author: mzxchandra

CLAUDE.md

@@ -483,7 +483,9 @@ Name the constant for what it is and give it an obviously-fake value, with the T
 const PLACEHOLDER_PASSWORD = 'not-a-real-password'
 ```
 
-Tokens and keys follow the same idea — `'tok-123'`, `'token-123'`, `'test-key'`, `'tok_1234567890abcdef'`. **Never build a fixture out of a real credential's structure**: a JWT header segment (`eyJhbGciOiJIUzI1NiJ9...`), a real-looking `sk-`/`ghp_`/`AKIA` prefix, or a plausible base64 blob all read as live secrets to the scanner. When a test needs a value with internal structure, keep the structure it actually exercises and make everything else unmistakably fake (`opaque-session-value-abc-trailing`, not a well-formed token).
+Tokens and keys follow the same idea — `'tok-123'`, `'token-123'`, `'test-key'`, `'tok_1234567890abcdef'`. **Never build a fixture out of a real credential's structure**: a genuine JWT header segment (the base64 of `{"alg":…}`, which every JWT starts with), a real-looking `sk-`/`ghp_`/`AKIA` prefix, or a plausible base64 blob all read as live secrets to the scanner. When a test needs a value with internal structure, keep the structure it actually exercises and make everything else unmistakably fake (`opaque-session-value-abc-trailing`, not a well-formed token).
+
+This paragraph deliberately describes those shapes instead of quoting them — a document warning about credential-shaped literals is a poor place to leave one.
 
 ## Utils Rules