Add DLP rules for Stripe and LLM-provider API keys

[blitzcrieg1]

Agents frequently handle Stripe (sk_live_...) and LLM-provider keys (OpenAI sk-..., Anthropic sk-ant-...). These leaking into a tool call is exactly what DLP is for.

Task

Add rules to policies/dlp/manifest.yaml for Stripe live/test keys ((?i)sk_(live|test)_[0-9a-z]{24,}) and a generic provider key (sk-[a-zA-Z0-9]{20,}). Category credentials, severity critical.

Acceptance criteria

• Fires + near-miss tests in test_dlp_scanner.py with fake keys (gitleaks:allow).
• pytest green.