fix(v2r2c1): avoid builder secret-scan false positives

scripts/build_v2r2c1_model_api_staging.py

@@ -34,10 +34,15 @@ def sha256(path: Path) -> str:
     return h.hexdigest()
 
 def private_marker(path: Path) -> bool:
+    import re
     text = path.read_text(encoding='utf-8', errors='ignore')
-    lowered = text.lower()
-    markers = ('-----begin private key-----', 'aws_secret_access_key', 'ghp_', 'sk-')
-    return any(marker in lowered for marker in markers)
+    patterns = (
+        r'-----BEGIN [A-Z ]*PRIVATE KEY-----',
+        r'(?<![A-Za-z0-9])sk-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])',
+        r'(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{20,}(?![A-Za-z0-9])',
+        r'(?i)aws_secret_access_key\s*[:=]\s*[A-Za-z0-9/+=]{16,}',
+    )
+    return any(re.search(pattern, text) for pattern in patterns)
 
 def main() -> int:
     ap = argparse.ArgumentParser()