Measure the '=[^=]' allowlist in generic-markup-config-secret

[aksOps]

Question

Does the '=[^=]' allowlist entry in secrets.generic-markup-config-secret suppress real credentials, and what replaces it?

Parent: #48
Blocked by: #49

crates/siloscan-core/rules/default/generic.yaml carries '=[^=]' in the allowlist of generic-markup-config-secret. It is the same defect class as two bugs already fixed on this rule family:

• 1.4.0's substring stopwords, where pass and word suppressed every real password containing those fragments
• the uncommented '=[^=]' entry in generic-password-assignment, which made = unreachable on password identifiers (0/7 before the fix, 7/7 after) and was replaced by two narrower entries at no cost in findings

This one was left alone deliberately, and the reasoning still holds as of 1.5.1: XML and web.config are the shapes both the siloscan corpus and the gitleaks corpus cover worst, and applying an unmeasured change to a rule aimed at exactly those shapes is how the 325-to-1222 regression happened.

So it is blocked on corpus coverage, not on analysis. Once #49 lands XML, web.config and .csproj shapes:

1. measure the entry's effect - remove it, count what appears, classify each
2. if it suppresses real credentials, replace it with entries narrow enough to name what they suppress, as generic-password-assignment did
3. if it earns its place, comment it with the measurement so the next reader does not re-litigate this

Deliverable: either a rule change with before/after counts, or a comment in generic.yaml recording why the entry stays.