feat(signals): extend public redaction for /var and Program Files paths

[jaso0n0818]

Summary

Extends the shared PUBLIC_UNSAFE_PATTERN in redaction.ts so public GitHub surfaces also redact common Linux /var/ and Windows Program Files install paths (#542 follow-up).

New blocked paths:

• /var/... (e.g. /var/log/app.log)
• C:\Program Files\... style Windows install directories

Test plan

• git diff --check
• npm run typecheck
• npm test -- test/unit/redaction.test.ts
• predicted gate: success (independent of open feat(signals): classify automation and CI toolchain config in path-matchers #1261/feat(signals): recognize e2e, integration, and snapshot test paths #1262 file areas)

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.33%. Comparing base (6138b9e) to head (7ad74a9).
⚠️ Report is 42 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1307   +/-   ##
=======================================
  Coverage   95.33%   95.33%           
=======================================
  Files         192      192           
  Lines       20750    20750           
  Branches     7500     7500           
=======================================
  Hits        19783    19783           
  Misses        383      383           
  Partials      584      584           

Files with missing lines	Coverage Δ
src/signals/redaction.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JSONbored]

Verdict: CLOSE — base conflict · hands-off, owner executes.

Correct/minimal redaction extension, but CONFLICTING.