Foundation: asset-checker and hygiene-scanner follow-ups from the #334 and #333 reviews #339

Non-blocking follow-ups from the #334 (image-check hardening) and #333 (hygiene entropy rule) reviews.

tools/check_recipe_assets.py (#334):

• _MAX_INFLATED is pinned by no test: setting it to 16 MiB or 4 GiB, or > to >=, survives the suite, although 16 MiB would reject the largest legal asset (1568x1568 RGBA-16: 19,670,560 bytes non-interlaced, 19,671,932 interlaced).
• The real memory bound is still the header-implied length: a 299 KB file with a 9000x9000 header made the Hygiene job peak at about 487 MB traced / 494 MB RSS (about 536 MB on the reviewers' machine). Consider a backstop near 32 MiB.
• expected + 2 as the inflate cap survives the suite; the exact + 1 is not pinned.

tools/check_hygiene.py (#333):

• The contrived api1_key= / access1_key= name still escapes the _SECRET_NAME rule.
• The "does not cover" docstring sentence still says only "all-lowercase or all-uppercase".
• assert all(... for ... in DIGIT_RUN_KEYWORDS) goes quiet if the list is emptied.

Acceptance: each item is fixed with a mutant-killing test, or recorded as a decided limit.