A line of code that only reads a secret from somewhere else is masked as if it were one

## What happens

The named-secret rule masks a line where a secret-like name is followed by `=` or `:` and a value that is quoted, contains a digit, or is at least 12 characters long (`Docs/clipboard-secrets.md` shape 5). An expression that *refers* to a secret often passes the length test, so ordinary code is masked.

## Measured (headless, `SecretShapes.matches`)

| Clip | Masked? |
|---|---|
| `let token = request.token` | **yes** |
| `const apiKey = process.env.API_KEY;` | **yes** |
| `secret = settings.SECRET_KEY` | **yes** |
| `password = getpass.getpass()` | **yes** |
| `token = os.environ["GITHUB_TOKEN"]` | no |
| `self.accessToken = accessToken` | no |
| `let password = passwordField.text ?? ""` | no |
| `if password == confirmPassword {` | no |

The rows that are masked and the rows that are not differ only in incidental punctuation, so a developer cannot predict which of their code clips will turn into dots.

## Why it matters

The doc accepts that a false positive is cheap: dots, and one action to reveal. For the long-identifier case, that trade is measured and written down. This case is not written down, and it lands on the most common thing a developer copies about credentials, which is the code that loads them. It also pushes those clips out of the Code tab and hides their language chip.

## Acceptance criteria

- A value that is an unquoted identifier path or call, such as `a.b`, `a.b.c`, `f()`, `a.b()` or `a["B"]`, and contains no run that would itself pass the entropy rule, does not count as a named secret. Quoted values and values containing digits still do.
- The masked rows above become unmasked, and every positive case in `SecretDetectionTests` still passes. Add cases such as `password = "` + value + `"` and `API_KEY=` + value, built at runtime from pieces.
- The oracle and scaling tests (`SecretShapesOracleTests`, `SecretShapesScalingTests`) are updated with the new rule and pass.
- `Docs/clipboard-secrets.md` describes the exception.

Start at SecretShapes.matches and read the existing SecretDetectionTests cases, then compare the oracle and scaling coverage in SecretShapesOracleTests and SecretShapesScalingTests. Update the named-secret matching behavior and add the specified positive and negative cases; finish by updating Docs/clipboard-secrets.md and running all named test suites.

Written by the indexing model from the issue text.