fix(orb): one shared token-redaction pattern across the five public surfaces (#9697)

[kai392]

What

Four hand-written token-redaction patterns guarded public-facing text in src/services/**, and every one missed something another caught. The worst gap: three surfaces (miner-dashboard-recommendations, control-panel-roles, weekly-value-report) matched only ghp_, so ghs_ — the GitHub App installation token this Worker mints on every pass via createInstallationToken — passed through a public dashboard string, role summary, and weekly report verbatim. The two path surfaces (score-breakdown, agent-action-explanation-card) matched the correct gh[pousr]_ GitHub class but not the Orb/GitLab/Slack prefixes the others caught.

How

• src/signals/redaction.ts: add PUBLIC_TOKEN_INLINE (the alternation source of every prefix — gh[pousr]_, github_pat_, gts_, orbenr_, orbsec_, glpat-, sk-, xox[baprs]-) and publicTokenPattern() returning a fresh /g RegExp on each call — the credential analogue of the existing PUBLIC_LOCAL_PATH_INLINE / PUBLIC_LOCAL_PATH_SCRUB_PATTERN. gh[pousr]_ is the correct GitHub class (same as src/review/secret-patterns.ts), covering ghp_/gho_/ghu_/ghs_/ghr_ at once.
• All five surfaces now compose from that single source, each keeping its own replacement string ("private context", "<redacted-token>", "<redacted>") and its own trailing body class / path alternation. No hand-written prefix literal remains under src/services/.

Tests

• miner-dashboard-recommendations: a named REGRESSION case for the ghs_ installation-token gap.
• control-panel-roles, weekly-value-report, score-breakdown, and a new agent-action-explanation-card test file: one it.each over every prefix in PUBLIC_TOKEN_INLINE, plus a non-token string left unmodified per site.
• redaction.test: publicTokenPattern() returns a fresh object each call and a repeated .replace() is idempotent (guards the shared-lastIndex regression).

134 tests pass across the six files; the old patterns provably miss ghs_/xoxb- (non-vacuous).

Closes #9697

[loopover-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 LoopOver is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.71%. Comparing base (1e1b004) to head (1fe01e4).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #9918       +/-   ##
===========================================
- Coverage   91.86%   79.71%   -12.16%     
===========================================
  Files         921      287      -634     
  Lines      113263    59130    -54133     
  Branches    27300     8873    -18427     
===========================================
- Hits       104046    47133    -56913     
- Misses       7929    11706     +3777     
+ Partials     1288      291      -997     

Flag	Coverage Δ
backend	99.81% <100.00%> (+4.13%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/services/agent-action-explanation-card.ts	100.00% <100.00%> (ø)
src/services/control-panel-roles.ts	100.00% <ø> (ø)
src/services/miner-dashboard-recommendations.ts	100.00% <ø> (ø)
src/services/score-breakdown.ts	99.21% <100.00%> (+<0.01%)	⬆️
src/services/weekly-value-report.ts	100.00% <100.00%> (ø)
src/signals/redaction.ts	100.00% <100.00%> (ø)

... and 767 files with indirect coverage changes