Document secret-shapes coverage limits

[steflsd]

@coderabbitai ignore

Docs only — no behaviour change.

The secret-shapes section described what the detector catches but not what it deliberately doesn't, which invites the assumption that enabling it covers any secret in any config an agent reads. Both fixes shipped in 0.2.3 (#85, #87) came out of that gap in understanding.

Adds a Known coverage limits section to docs/plugins.md:

• Distinguishes the value-only patterns (caught anywhere, regardless of key) from the two key/value pairing patterns, whose limits only bite for opaque values.
• Tabulates the three positions where an opaque value is missed — secret-ish word at the start of the key, decoration between separator and value, flag forms with no separator — each with the reason it isn't simply widened. The first carries the measurement: relaxing it costs +83% detections on a 4,000-file corpus, nearly all identifiers and i18n keys.
• Documents the path-shaped-value rejection from Stop secret-shape detection from swallowing file paths #85 so it reads as intentional rather than as a detector miss.
• Restates that none of this touches the exact-match promise for registered values.

Cross-referenced from the threat model's "Intentionally not covered" list, which previously had no entry for best-effort detector misses.

🤖 Generated with Claude Code