test(settings): add policy compiler sanitizer fixtures

[Lobster-0429]

Summary

• Implements test(settings): add policy compiler sanitizer fixtures #300: adds policy compiler sanitizer fixtures for the settings/roles/readiness system
• Exports sanitizeRoleText via __controlPanelRolesInternals so the sanitizer can be unit-tested directly with adversarial inputs
• Adds test/unit/policy-sanitizer.test.ts with 46 targeted fixture tests covering all five required areas

Closes: #300

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck — clean
• npm run test:coverage locally — 818 pass (1 skipped); pre-existing Windows failures confirmed on main before this branch; coverage stays above 97%
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• UI/MCP/worker checks not applicable — this PR is tests-only (one small export change + new test file)

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (not applicable)
• API/OpenAPI/MCP behavior is updated and tested where needed. (not applicable — no public API surface changed)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (not applicable)
• Visible UI changes include screenshots or a short recording. (not applicable)
• Public docs/changelogs are updated where needed. (not applicable)

Notes

Fixture coverage by category:

• sanitizeRoleText path redaction — Unix /Users, /home, /tmp and Windows C:\Users paths are entirely consumed by the regex, leaving <redacted-path>; text surrounding paths is preserved
• Token redaction — ghp_, github_pat_, gts_, glpat-, Bearer tokens each produce <redacted-token>; short strings below the 8-char minimum are left unchanged
• Private term redaction — All 13 forbidden terms (wallet, hotkey, coldkey, raw trust, trust score, payout, reward estimate, farming, private reviewability, public score estimate, seed phrase, mnemonic, private key) trigger a full <redacted> response
• Contribution lanes — onboarding.nextActions verified clean across needs_setup, ready (miner/maintainer), and operator states; adversarial repo names containing private terms are sanitized in role cards
• Label guidance — appliedLabel, labelPolicy, and permission-warning text in settings-preview are verified private-term-free
• Validation guidance — checkRun decisions, decidePublicSurface summaries, and config recommendation tradeoffs/reasons are verified private-term-free
• Readiness warnings — blockers and warnings verified clean for blocked/unregistered repos, strained intake, upstream drift, and no-label-pipeline states
• Onboarding-pack inputs — publicSafe: true enforced; buildGittensorConfigRecommendation privateOnly: true is verified; no user-facing wallet/hotkey/trust language in any serialized output

[JSONbored]

@web-dev0521 this is a straightforward coverage improvement.

A few notes:

• The sanitizer fixture cases are useful because this surface affects public-safe policy output.
• The change stays test-focused and does not introduce behavior drift.
• The PR metadata is complete enough for review.

No code changes requested.

Validation expected:

• Keep the settings/unit suite green through merge.