feat(egress): decode-rescan feeds base64 plaintext to secret-egress (review MINOR)

Output gate step 3 now runs scan_secret_egress over every decoded base64
blob's plaintext, not only scan_lexicon. A base64-wrapped credential that
formerly vanished (decode fed the lexicon, which has no secret patterns)
now surfaces as decoded:egress:* carrying the blob offset. Evidence stays
length-only, so the decoded finding never leaks the secret value.

Hex-wrapped secrets remain a documented honest-limit (entropy exposes
decoded plaintext for base64 only). README honest-limits + CLAUDE.md
Kontekst updated; 3 tests added (347 passed, was 344).

README.md

@@ -152,6 +152,12 @@ that a green scan means safe content:
   collapses to one finding at its first location. This keeps reports readable, but
   a caller that counts occurrences or needs every offset of a repeated pattern sees
   only the first: a deliberate readability tradeoff, not full positional coverage.
+- **Secret egress: base64-wrapped is caught, hex-wrapped is not.** The output gate
+  decodes base64 blobs and re-scans the plaintext through the credential/egress set,
+  so a base64-*wrapped* secret surfaces as `decoded:egress:*` rather than vanishing.
+  A *hex*-wrapped secret does not: `entropy` exposes decoded plaintext for base64
+  only, so hex (and other encodings, or nested wraps) is a deliberate boundary, not
+  a silent miss — decode the transport layer first if you need it scanned.
 
 ## Out-of-scope (documented boundary)