feat: add repository mesh reconciliation round

tests/test_redaction_acceptance.py

@@ -61,6 +61,15 @@ Bearer abcdefghijklmnopqrstuvwxyz1234567890
         self.assertEqual(len(findings), 1)
         self.assertEqual(findings[0].pattern_id, "cloudflare_token_assignment")
 
+    def test_redaction_flags_cfat_even_when_named_as_reference(self) -> None:
+        findings = scan_text_for_secrets("route.md", "tokenRef=cfat_abcdefghijklmnopqrstuvwxyz1234567890")
+        self.assertEqual(len(findings), 1)
+        self.assertEqual(findings[0].pattern_id, "cloudflare_cfat_token")
+
+    def test_redaction_allows_single_opaque_reference_line(self) -> None:
+        findings = scan_text_for_secrets("route.md", "credentialRef: cf-token-prod-readonly")
+        self.assertEqual(findings, ())
+
     def test_acceptance_report_handles_missing_artifacts(self) -> None:
         root = make_tmp()
         bundle = ReportBundle(