Provider keys: one per environment, zero in the logs — step 6 of 7

Build the scanner you'd run over yesterday's logs after finding one leak (there is never just one). Write scan_logs(lines) that returns a list of 1-based line numbers for every line containing either key prefix "sk-ant-" or "sk-test-".

The script then prints one rotation order per flagged line.

Expected output:

line 2: rotate the key, then scrub the log
line 4: rotate the key, then scrub the log