Avoid false secret detections for authenticated canary attestations

[8Dionysus]

Problem

Authenticated canary attestations contain model and owner payload material that is intentionally bound by the canary contract. The generic secret-material scan treated those authenticated fields as collisions, so a valid canary result could be rejected before the attestation was consumed.

Change

• Exclude only the authenticated canary attestation fields from the generic secret scan while continuing to scan all other model and owner payload fields.
• Keep the existing attestation, tamper, and secret rejection paths unchanged for unauthenticated or unrelated payload material.
• Add regression coverage for an attested payload that must pass and for a nearby collision that must still fail.
• Regenerate the portable owner-family KAG projection and commit its budget receipt.

Validation

• test_canary.py: 31 passed.
• test_stack_mcp.py -k 'secret or tamper': 28 passed.
• test_observation_producer.py -k tamper: 1 passed.
• Ruff, generated-contract check, and validate_stack_mcp: passed.
• Pinned owner-family gate: all incremental-sentinel, full-parity, family-contract, and compatibility-assembly checks passed.

The source fix is 2aed2f26effccc951ca5628c32825e4f0889550a; the generated KAG companion is f86ddf5c132c13b19de00700ab8c0fb0013c946a. The checkpoint review for the companion commit returned review_status=reviewed.

KAG provenance

The generated portable family uses base, history, and event-history ref 03b9d8664a3b7a4cb09b76e626f11bb3e4666889. The checked-in budget receipt records family digest 6e8b237cf2bd3c4ad947b07704333b7547675c7d352ad49d301c2858a0799b67, 103 changed generated files, and 12,068,959 changed generated bytes.

Claim boundary

This PR provides source, regression, generated-projection, receipt, and local pinned-gate evidence. CI, merge, deployment, runtime installation, and live acceptance remain separate checks.