GitLab runner authentication tokens

• gitleaks 8.30.1
• Reference 1
• Reference 2
• Reference 3

Graduated arrival contract (registry detector since redact-secret#730). Lexical separability decided before authoring (#212): the provider-documented glrt- prefix plus either a 20-character friendly-token body (optionally after the legacy t<hex>_ partition segment) or the routable <base64url>.<2 base36>.<2 base36 length><7 base36 CRC32> grammar separates a runner authentication token from the recorded confusables (s_<12 hex> system ids, 8-character short_sha values, runner ids, masked/REDACTED values, references). Only the glrt- prefix is provider-documented; the legacy body (Devise friendly_token, 20 chars) and the routable grammar and checksum come from GitLab's own code (routable_token.rb, runner.rb) and GitLab's provider-authored secret-detection rules, so the contract is T2. The routable checksum is recomputable offline: `validate` re-checks the base36 length holder and the CRC32, and the generator computes both over synthetic bytes. Not claimed: glrtr- tokens (documented prefix for runners registered with a registration token; current shape unverified), instance-prefixed <admin-prefix>-glrt- tokens (self-managed, feature-flagged), the unversioned single-dot routable design form, and exact issuance windows. glrtr- values, GR1348941 registration tokens and other gl-stem tokens are real secrets and are never controls. Pinned peers: gitleaks gitlab-runner-authentication-token matches the 20-character body (truncating longer tokens at 25 bytes) and its routable rule requires a t<d>_ segment and a single dot, so it matches neither GitLab's versioned routable shape; trufflehog 3.97.4 has no glrt- detector.