fix(services): remediation-plan.ts's forbidden-word regex fails to catch the plural "rankings"

[JSONbored]

⚠️ Definition of Done: this issue must be completed in full, in a single PR. Do not split this
work across multiple PRs, and do not defer any Deliverable below to a follow-up issue. A PR that
satisfies only some of the Deliverables, stubs a required test, or leaves a checkbox
partially-done does NOT resolve this issue and will be closed.

Context

src/services/remediation-plan.ts:38's FORBIDDEN_PATTERN = /\b(reward\w*|wallet|...|ranking|...)\b|.../i uses \breward\w*\b (handles plural via \w*) but only bare ranking with no \w*/? suffix -- and since the trailing \b requires a word boundary immediately after "ranking", it can never match inside "rankings" (no boundary between "g" and "s"). Verified directly: FORBIDDEN_PATTERN.test("this shows the rankings of contributors") returns false, while "...the ranking of..." returns true. The existing test (test/unit/remediation-plan.test.ts:197) only exercises the singular form.

Requirements

Change ranking to rankings? in FORBIDDEN_PATTERN, matching the fix already applied to the sibling regex in input-model.ts per #913, and add a test case for the plural form.

Deliverables

• FORBIDDEN_PATTERN in remediation-plan.ts matches both "ranking" and "rankings"
• A test in test/unit/remediation-plan.test.ts asserting the plural form "rankings" is caught

All of the above Deliverables are required in the same PR unless the deliverable text itself states otherwise.

Test Coverage Requirements

src/** -- 99%+ patch coverage, branch-counted, including the new plural-form test.

Expected Outcome

A PR-body-reused remediation checklist correctly flags the plural "rankings" term, closing a public-safety leak in a regex that already handles the plural for every other similar term.

Links & Resources

• src/services/remediation-plan.ts:38
• test/unit/remediation-plan.test.ts:197

[linear-code]

JSO-6165