修复巡检报告隐私字段并记录 Wave4-5 公网验证（05-29-frontend-ux-wave4-5-finance-admin-refresh）

.trellis/spec/hyb-oa/docs-and-evidence.md

@@ -44,6 +44,9 @@ Start from `docs/文档索引.md` and `docs/文档事实源状态矩阵.md`.
 - Machine-readable reports must not include amounts, prices, costs, balances,
   bank details, invoice values, full accounts, tokens, secrets, raw payloads,
   raw form values or full local paths.
+- Credential/readiness presence reports must use safe business labels, not raw
+  env key names. For example, emit `adminCredentialReady: true` instead of a
+  field named after a credential-value environment variable.
 
 ### 4. Validation & Error Matrix
 
@@ -55,6 +58,8 @@ Start from `docs/文档索引.md` and `docs/文档事实源状态矩阵.md`.
   according to whether the parent step is required.
 - Privacy smoke match -> write redacted finding metadata and make final
   summary reflect the failure.
+- Secret-like field names in generated reports -> privacy finding, even when
+  the value is only a boolean presence flag.
 
 ### 5. Good/Base/Bad Cases
 
@@ -73,6 +78,8 @@ Start from `docs/文档索引.md` and `docs/文档事实源状态矩阵.md`.
   - child finding count is visible in parent summary;
   - privacy step is present in parent summary;
   - `summary.json` has no full workspace path or business amount fields.
+- For live/readiness env reports, assert the JSON contains safe readiness
+  labels and does not contain raw secret-like env key names.
 - Run the matching launch/readiness aggregator when it consumes the report.
 
 ### 7. Wrong vs Correct
@@ -87,6 +94,14 @@ Start from `docs/文档索引.md` and `docs/文档事实源状态矩阵.md`.
 }
 ```
 
+```json
+{
+  "liveSmoke": {
+    "RAW_CREDENTIAL_ENV_KEY": true
+  }
+}
+```
+
 #### Correct
 
 ```json
@@ -102,3 +117,11 @@ Start from `docs/文档索引.md` and `docs/文档事实源状态矩阵.md`.
   }
 }
 ```
+
+```json
+{
+  "liveSmoke": {
+    "adminCredentialReady": true
+  }
+}
+```