Sentry: privacy scrubber (beforeSend redaction) — non-negotiable

[JSONbored]

Part of #998.

Context

Sentry events can sweep up sensitive data. A beforeSend / beforeSendTransaction scrubber MUST strip it before anything leaves the Worker — this is the gate that keeps Sentry consistent with gittensory's privacy boundary.

Deliverables

• beforeSend scrubber removing: PR title/body/diff content, the private rubric / gate prompts, guardrail paths, GitHub/installation tokens, BYOK keys, internal secrets, and wallet/reward/raw-score/scoring context.
• Never attach request bodies or PR content; send error + stack + minimal tagged context only.
• Reuse the existing redaction discipline (public-comment redactors / sanitizePublicComment) so scrubbing stays in sync with the comment surface.
• Default-deny unknown event context keys (allow-list).

Requirements / acceptance

• A test corpus of representative errors/transactions shows zero sensitive tokens/content in the outgoing payload.
• Fail-safe: a scrubber exception drops the event rather than sending it unscrubbed.