fix(verifier): accept bounded API key placeholders

[tiammomo]

Closes #141

Accept strict your-provider-api-key placeholders in tracked environment templates so public example files can enter isolated verification.

---

Extend the bounded full-match placeholder policy alongside the existing replace-with format. Preserve all filename, encoding, size, regular-file, directory and sensitive-value checks. Regression coverage includes public provider placeholders, multi-part provider names, the exact 128-character boundary, and malformed or sensitive-looking values. The new regression failed before the fix; isolated pre-commit validation passed all 603 tests, lint, formatting, CLI smoke and build.

Verified with uv run --python 3.12 python -W error::ResourceWarning -m unittest discover -s tests -v, uvx ruff check ., uvx ruff format --check ., uv run reposteward --help, uv build --offline.

Areas for careful review:

• No known behavior changes outside the reported bug.

Implementation assistance: an external coding workspace was used to prepare the change and its
tests. tiammomo reviewed the final diff, understands it, and takes responsibility
for this contribution.