[Feature]: make secret patterns configurable and add common token formats

## Package

Other — `agent-governance-opencode`

## Problem Statement

The secret detectors in `lib/policy.mjs` are hardcoded, so operators cannot add organization-specific credential formats without forking or post-processing output. The built-in set also omits common chat-platform credentials such as Slack `xoxb-`, `xoxp-`, `xapp-`, and webhook URLs.

## Impact

Agents frequently handle output from chat, issue tracking, CI, package registries, and databases. Credentials from those systems can pass through the current seven-pattern set. We currently run a second redaction pass, which works but duplicates scanning and cannot participate in AGT's audit record.

## Proposed Solution

- Add a validated `secretPatterns` policy key.
- Merge configured patterns with built-ins rather than replacing the safe defaults.
- Report stable pattern identifiers only; never log matched values.
- Add common formats to the defaults, including Slack tokens/webhooks, GitHub App tokens, npm tokens, Google API keys, Atlassian tokens, and database connection strings where false-positive behavior is acceptable.
- Add tests for redaction, invalid/unsafe regexes, and duplicate pattern IDs.

## Alternatives Considered

- A downstream second redaction pass. This works but splits policy, reporting, and audit behavior.
- Forking `policy.mjs`. This creates an unnecessary maintenance burden.

## Priority

Important

## Contribution

- [x] I would be willing to submit a PR for this feature

## Coordination status

No implementation PR is currently linked (checked 2026-08-11). The advisory-mode redaction defect is separately tracked by #3665 and #3674; #3295 contains related OpenCode secret-read regex hardening but does not implement this configuration surface.

Contributors are welcome to propose an implementation. Please comment here before starting, search open PRs for overlapping work, and include `Closes #3667` in the PR description.

Start in lib/policy.mjs by tracing the existing seven secret patterns, policy handling, redaction, and audit reporting. Use the requested configurable patterns, stable identifiers, built-in formats, and validation cases as acceptance criteria, then add tests covering redaction, invalid or unsafe regexes, and duplicate pattern IDs.

Written by the indexing model from the issue text.