test(service-automation): give the activation-ledger api entry-path fixture its per-flow secret

The fixture pins the ledger-disabled refusal on the api entry path; an api
flow now registers only with a config.secret (ADR-0041), so the fixture
declares one.

Claude-Session: https://claude.ai/code/session_017B6YKCGu8CTY2KBWgwaHAs
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/services/service-automation/src/flow-activation-ledger.test.ts

@@ -148,7 +148,8 @@ describe('ADR-0126 §7.2 — a ledger-disabled flow refuses at the execute() sea
         ['record-change', { objectName: 'lead', triggerType: 'record-after-create' }, 'record_change'],
         ['schedule', { schedule: '0 9 * * *' }, 'schedule'],
         ['time-relative', { timeRelative: { object: 'task', field: 'due_at' }, schedule: '0 * * * *' }, 'time_relative'],
-        ['api', { triggerType: 'api' }, 'api'],
+        // An `api` flow registers only with its per-flow secret (ADR-0041).
+        ['api', { triggerType: 'api', secret: 'hook-secret' }, 'api'],
     ];
 
     for (const [label, startConfig, triggerKey] of entryPaths) {