fix(ci): stabilize detect-secrets baseline

.secrets.baseline

@@ -203,7 +203,7 @@
         "filename": "apps/macos/Sources/OpenClawProtocol/GatewayModels.swift",
         "hashed_secret": "7990585255d25249fb1e6eac3d2bd6c37429b2cd",
         "is_verified": false,
-        "line_number": 1745
+        "line_number": 1749
       }
     ],
     "apps/macos/Tests/OpenClawIPCTests/AnthropicAuthResolverTests.swift": [
@@ -264,7 +264,7 @@
         "filename": "apps/shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift",
         "hashed_secret": "7990585255d25249fb1e6eac3d2bd6c37429b2cd",
         "is_verified": false,
-        "line_number": 1745
+        "line_number": 1749
       }
     ],
     "docs/.i18n/zh-CN.tm.jsonl": [
@@ -11123,7 +11123,7 @@
         "filename": "extensions/nextcloud-talk/src/channel.ts",
         "hashed_secret": "71f8e7976e4cbc4561c9d62fb283e7f788202acb",
         "is_verified": false,
-        "line_number": 399
+        "line_number": 403
       }
     ],
     "extensions/nostr/README.md": [
@@ -12410,28 +12410,28 @@
         "filename": "src/gateway/auth.test.ts",
         "hashed_secret": "db5543cd7440bbdc4c5aaf8aa363715c31dd5a27",
         "is_verified": false,
-        "line_number": 95
+        "line_number": 96
       },
       {
         "type": "Secret Keyword",
         "filename": "src/gateway/auth.test.ts",
         "hashed_secret": "d51f846285cbc6d1dd76677a0fd588c8df44e506",
         "is_verified": false,
-        "line_number": 112
+        "line_number": 113
       },
       {
         "type": "Secret Keyword",
         "filename": "src/gateway/auth.test.ts",
         "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
         "is_verified": false,
-        "line_number": 254
+        "line_number": 255
       },
       {
         "type": "Secret Keyword",
         "filename": "src/gateway/auth.test.ts",
         "hashed_secret": "a4b48a81cdab1e1a5dd37907d6c85ca1c61ddc7c",
         "is_verified": false,
-        "line_number": 262
+        "line_number": 263
       }
     ],
     "src/gateway/call.test.ts": [
@@ -12622,7 +12622,7 @@
         "filename": "src/infra/outbound/outbound.test.ts",
         "hashed_secret": "804ec071803318791b835cffd6e509c8d32239db",
         "is_verified": false,
-        "line_number": 850
+        "line_number": 896
       }
     ],
     "src/infra/provider-usage.auth.normalizes-keys.test.ts": [
@@ -12916,7 +12916,7 @@
         "filename": "src/telegram/monitor.test.ts",
         "hashed_secret": "5934c4d4a4fa5d66ddb3d3fc0bba84996c17a5b7",
         "is_verified": false,
-        "line_number": 603
+        "line_number": 641
       }
     ],
     "src/telegram/webhook.test.ts": [
@@ -13011,5 +13011,5 @@
       }
     ]
   },
-  "generated_at": "2026-03-07T23:50:03Z"
+  "generated_at": "2026-03-08T01:23:32Z"
 }

src/daemon/systemd.test.ts

@@ -601,7 +601,7 @@ describe("readSystemdServiceExecStart", () => {
     });
     expect(command?.environmentValueSources).toEqual({
       OPENCLAW_GATEWAY_TOKEN: "file",
-      OPENCLAW_GATEWAY_PASSWORD: "file",
+      OPENCLAW_GATEWAY_PASSWORD: "file", // pragma: allowlist secret
     });
   });
 });

src/gateway/connection-auth.test.ts

@@ -404,7 +404,7 @@ describe("resolveGatewayConnectionAuth", () => {
         config,
         env,
         includeLegacyEnv: false,
-        localPasswordPrecedence: "config-first",
+        localPasswordPrecedence: "config-first", // pragma: allowlist secret
       }),
     ).rejects.toThrow("gateway.auth.password");
     expect(() =>
@@ -412,7 +412,7 @@ describe("resolveGatewayConnectionAuth", () => {
         cfg: config,
         env,
         includeLegacyEnv: false,
-        localPasswordPrecedence: "config-first",
+        localPasswordPrecedence: "config-first", // pragma: allowlist secret
       }),
     ).toThrow("gateway.auth.password");
   });

src/gateway/credentials.ts

@@ -265,7 +265,7 @@ export function resolveGatewayCredentialsFromConfig(params: {
     }
     if (
       localPasswordRef &&
-      localPasswordPrecedence === "config-first" &&
+      localPasswordPrecedence === "config-first" && // pragma: allowlist secret
       !localPassword &&
       Boolean(envPassword) &&
       localPasswordCanWin