security: redact the revoked GitLab PAT from QUICKSTART.adoc (#535)

Removes the dead credential from the working tree. **Owner revoked the
token 2026-07-27.**

## What was there

Committed **2026-02-22** ("Auto-commit: Sync changes"), **40
occurrences** in one file, on **public** `main` for five months.

Replaced with `glpat-<REVOKED-TOKEN-REDACTED>` rather than deleting the
surrounding documentation, which is otherwise legitimate.

| check | before | after |
|---|---|---|
| live-token occurrences in file | 40 | **0** |
| whole-tree grep for a live PAT | 1 file | **no matches** |
| AsciiDoc mirror scan findings | 72 | **0** |
| files changed | — | 1 |

## ⚠ History is deliberately NOT rewritten — please read

A rewrite was authorised. I measured it before running it, and the cost
now outweighs the benefit:

- The estate carries **2,021 pinned references** to **32 distinct
`standards` commit SHAs** (`uses:
hyperpolymath/standards/.github/workflows/*.yml@<sha>`).
- Those SHAs are **real commits in this history** — verified, e.g.
`c65436ee` (181 wrappers) and `d135b05` (83 wrappers).
- **A rewrite orphans every one of them.** Unreachable commits are
GC-able, and once collected every pinned caller fails to resolve its
`uses:` — precisely the estate-wide `startup_failure` class this repo
has spent the week eliminating.
- **The token is already revoked**, so a rewrite now buys hygiene, not
security.

A dead credential sitting in history is the cheaper problem than 2,021
broken workflow references.

If you still want the rewrite, it should be **sequenced with a
pin-refresh sweep** across all 2,021 references rather than done
standalone. A **full backup bundle of all refs was taken** before this
was evaluated and is retained.

## Note

`standards` already carries **zero** Nix artefacts (no
`flake.nix`/`flake.lock`/`default.nix`/`shell.nix`) — it is already
Guix-only, with `guix.scm` plus 8 manifests. Nothing to retire here.

Refs #528 — this is the leak that scanner could not see until the
AsciiDoc blind spot was closed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath