test: harden DWH auth review gates

scripts/test-dwh-auth-secret-scan.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root=$(cd "$(dirname "$0")/.." && pwd -P)
+pattern='thtdwh_v1\.[A-Za-z0-9_-]{16}\.[A-Za-z0-9_-]{43}'
+
+set +e
+rg --quiet --hidden --glob '!.git/**' -P -- "$pattern" "$repo_root"
+scan_status=$?
+set -e
+
+case "$scan_status" in
+  0)
+    printf '%s\n' 'dwh-auth credential literal scan failed' >&2
+    exit 1
+    ;;
+  1)
+    printf '%s\n' 'dwh-auth credential literal scan passed'
+    ;;
+  *)
+    printf '%s\n' "dwh-auth credential literal scan failed (rg status $scan_status)" >&2
+    exit "$scan_status"
+    ;;
+esac