test(provenance): give the label-protection test a live matcher again

Cursor caught the third instance of the same shape: the fixture `TOK` is three
characters, so the floor drops it and the matcher is empty. The assertion was
`'Bearer {{TOKEN}}'` in and out, which an empty matcher satisfies exactly as well
as working label protection — the test could no longer tell them apart.

Use a fixture over the floor whose label still contains its own plaintext, and
project the bare plaintext first. That control fails if the matcher is inert, so
the atomic-label assertion beside it can only pass for the right reason.

Auditing every test on this branch for the shape — all fixtures below the floor —
returned twenty-four, but the rest are sound: most assert that nothing is
substituted, which the floor makes more certain rather than less, and the
remainder run through the resolver's causal path, which never consults a matcher.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/executor/utils/resolved-secret-content-projection.test.ts

@@ -292,13 +292,22 @@ describe('projectResolvedSecretModelContent', () => {
 
   it('atomically projects the selected provenance label when its name contains the value', () => {
     const registry = new ResolvedSecretTraceRegistry([
-      { name: 'TOKEN', plaintext: 'TOK', encryptedValue: 'ciphertext' },
+      { name: 'TOKENVALUE_NAME', plaintext: 'TOKENVALUE', encryptedValue: 'ciphertext' },
     ])
-    registry.recordResolved('TOKEN', 'TOK')
+    expect(registry.recordResolved('TOKENVALUE_NAME', 'TOKENVALUE')).toBe(true)
 
-    expect(projectResolvedSecretModelContent('Bearer {{TOKEN}}', registry)).toEqual({
+    /**
+     * The label `{{TOKENVALUE_NAME}}` contains the plaintext that produced it, so it is only left
+     * alone because the label is treated atomically. Projecting the bare plaintext first proves the
+     * matcher is live — without it an empty matcher would satisfy the second assertion too.
+     */
+    expect(projectResolvedSecretModelContent('Bearer TOKENVALUE', registry)).toEqual({
+      safe: true,
+      value: 'Bearer {{TOKENVALUE_NAME}}',
+    })
+    expect(projectResolvedSecretModelContent('Bearer {{TOKENVALUE_NAME}}', registry)).toEqual({
       safe: true,
-      value: 'Bearer {{TOKEN}}',
+      value: 'Bearer {{TOKENVALUE_NAME}}',
     })
   })