Fix the ruff group 6 findings in the code #791 added

#791 landed on main after this stack branched. S105, which this PR
enables, flags two values that only look like secrets, and each keeps a
reasoned suppression: the redaction pattern for secret-looking key names
in the Stage 12 failure-cause module, and the fake database password its
tests check redaction removes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: anth-volk

projects/policyengine-simulation-executor/src/policyengine_simulation_executor/stage12_runtime/failure_causes.py

@@ -86,7 +86,7 @@
 )
 _BEARER_TOKEN = re.compile(r"(?i)\bbearer\s+[A-Za-z0-9._~+/=-]+")
 _SECRET_KEY = (
-    r"[\w-]*(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key"
+    r"[\w-]*(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key"  # noqa: S105  # a pattern for secret-looking key names, not a secret
     r"|private[_-]?key|credentials?|signature|sig)"
 )
 _SECRET_ASSIGNMENT = re.compile(

projects/policyengine-simulation-executor/tests/test_stage12_failure_causes.py

@@ -20,7 +20,7 @@
 from pydantic import BaseModel, TypeAdapter, ValidationError
 from sqlalchemy.exc import IntegrityError, OperationalError
 
-DATABASE_PASSWORD = "pooler-password-value"
+DATABASE_PASSWORD = "pooler-password-value"  # noqa: S105  # fake password; the tests check that redaction removes it
 DATABASE_URL = (
     f"postgresql://postgres.project:{DATABASE_PASSWORD}"
     "@pooler.example.com:5432/postgres"