feat(curator): vendor the backend application under scenarios/curator/backend

The curator app (Python backend, tests, systemd units, config, scripts) now lives in this repo under scenarios/curator/backend, exported from the standalone checkout's tracked tree (.pi mirror, venv and caches excluded). 149 unit tests pass from the new location; _SHARED_LIB and eval GOLDEN_DIR resolve unchanged. History not preserved per decision.

verify-no-secrets: the ASSIGN heuristic now requires the value to carry entropy (a digit or uppercase letter), so vendored Python kwargs like token=extraction_token no longer false-positive while real base64/hex/random secrets still trip it.

scripts/verify-no-secrets.sh

@@ -81,8 +81,11 @@ declare -a PATTERNS=(
   '-----BEGIN [A-Z ]*PRIVATE KEY-----'
 )
 
-# key-ish assignment with a long opaque value
-ASSIGN='(?i)(api[_-]?key|apikey|secret|token|password|passwd|access[_-]?key)["'"'"' ]*[:=]["'"'"' ]*[A-Za-z0-9/_+=-]{16,}'
+# key-ish assignment with a long opaque value. The value must carry entropy (a
+# digit or an uppercase letter): real secrets are base64/hex/random, while
+# snake_case source identifiers like `token=extraction_token` are not, and used
+# to trip this rule once the Python backend was vendored into the repo.
+ASSIGN='(?i)(api[_-]?key|apikey|secret|token|password|passwd|access[_-]?key)["'"'"' ]*[:=]["'"'"' ]*(?-i:(?=[A-Za-z0-9/_+=-]{16,})(?=[A-Za-z0-9/_+=-]*[A-Z0-9]))[A-Za-z0-9/_+=-]{16,}'
 
 for f in "${FILES[@]}"; do
   [ -f "$f" ] || continue