fix(signals): extension overlay's forbidden-term redaction has drifted from the canonical PUBLIC_UNSAFE_TERMS vocabulary

[JSONbored]

Context

redactExtensionText in src/signals/extension-contributor-context.ts (line 27-29) is the browser-extension overlay's defense-in-depth scrubber: every free-form text (issue/PR titles, reasons, warnings, readiness-component evidence) reaching the contributor overlay is re-checked against FORBIDDEN_EXTENSION_TERMS (lines 24-26) before it leaves the server, per the module's own header comment ("all free-form text is re-checked against the forbidden-private-term list before it leaves the server").

src/signals/redaction.ts defines the canonical public/private boundary vocabulary, PUBLIC_UNSAFE_TERMS (line 23), used across every other public surface in the codebase (PR/issue comments, check annotations, notifications, badges, slop/advisory reasons). It explicitly includes bare cohort\w*, bare ranking\w*, miner[-_\s]?originated, human[-_\s]?originated, and standalone reviewability as private/economic-identity terms that must never leak to a public surface.

FORBIDDEN_EXTENSION_TERMS in extension-contributor-context.ts is a separately hand-maintained regex that has drifted from this canonical vocabulary — it is missing:

• bare cohort
• bare ranking
• miner-originated / human-originated
• standalone reviewability (it only covers the compound phrases reviewability internals / private reviewability, not the bare word)

Confirmed at runtime that strings like "Cohort diagnostics flagged this PR", "Your ranking dropped this week", "This looks miner-originated, not human-originated", and "Reviewability is limited right now" all pass through redactExtensionText completely unredacted.

redaction.ts's own comment explicitly names only two files as intentionally-curated exceptions to the shared vocabulary: agent-action-explanation-card.ts and miner-dashboard-recommendations.ts (both deliberately redact phrases, not just words, for cleaner output). extension-contributor-context.ts is not one of the named exceptions, so this reads as unintentional drift rather than a documented design choice. test/unit/extension-contributor-context.test.ts (line 11) has its own local assertion regex with the same gaps, so no existing test would catch a leak of these specific terms.

Requirements

• Extend FORBIDDEN_EXTENSION_TERMS in src/signals/extension-contributor-context.ts to cover the missing terms: bare cohort, bare ranking, miner-originated/human-originated (any of -/_/whitespace as the separator, matching PUBLIC_UNSAFE_TERMS's own [-_\s]? convention), and standalone reviewability (not just the compound phrases already covered).
• Prefer composing from PUBLIC_UNSAFE_TERMS's existing alternation source (src/signals/redaction.ts, exported as a plain string, no flags/anchors — designed for composition, per its own doc comment) rather than hand-retyping the term list a second time, if that can be done without introducing a cycle (the module's header comment notes it is "kept local (no import) so this module stays cycle-free" — verify whether importing just the string constant, not the whole redaction module's logic, is safe, and if not, keep the terms hand-synced but add the drift-guard test below so future drift is caught mechanically instead of silently).
• Do not remove or narrow any term already in FORBIDDEN_EXTENSION_TERMS — this is a strictly additive tightening.
• Do not change redactExtensionText's replacement behavior ("[redacted]" + whitespace collapse) or its call sites.

Deliverables

• FORBIDDEN_EXTENSION_TERMS updated to redact bare cohort, bare ranking, miner-originated/human-originated, and standalone reviewability.
• test/unit/extension-contributor-context.test.ts updated with regression cases for each of the four newly-covered terms (asserting redactExtensionText now redacts "Cohort diagnostics flagged this PR", "Your ranking dropped this week", "This looks miner-originated, not human-originated", and "Reviewability is limited right now").
• A drift-guard test (or code-level composition, if importable without a cycle) that keeps FORBIDDEN_EXTENSION_TERMS and PUBLIC_UNSAFE_TERMS from silently diverging again — e.g. a test that checks every term matched by PUBLIC_UNSAFE_TERMS on a representative fixture string is also caught by redactExtensionText, excluding only the terms this module's own comment or a maintainer explicitly marks as an intentional exception.

Test Coverage Requirements

Aim for 99%+ Codecov patch coverage (100% including invariants) on the touched lines in src/signals/extension-contributor-context.ts. This is a privacy/redaction-boundary bug fix, so explicit before/after regression tests for each newly-covered term are required, not just incidental line coverage.

Expected Outcome

Text reaching the browser-extension contributor overlay now redacts the same private economic/identity vocabulary as every other public surface in the codebase — cohort, ranking, miner-originated/human-originated, and bare reviewability no longer leak through redactExtensionText unredacted, closing the drift between this surface's hand-maintained term list and the canonical PUBLIC_UNSAFE_TERMS vocabulary.

Links & Resources

• src/signals/extension-contributor-context.ts (FORBIDDEN_EXTENSION_TERMS, lines 24-26; redactExtensionText, lines 27-29; call sites at lines 50, 55-56, 75, 125, 127-128)
• src/signals/redaction.ts (PUBLIC_UNSAFE_TERMS, line 23, and its doc comment on the two named curated exceptions)
• test/unit/extension-contributor-context.test.ts (line 11, local assertion regex to update)
• Related precedent: #1375 (fix(signals): public-safety boundary does not redact /root/ local paths — same class of redaction-boundary bug in a sibling module)

[linear-code]

JSO-4023