test: pin the security-property regression guards from pre-landing review

The pre-landing review found the fixes were correct but three regression guards
were missing — each pins a property whose silent revert would keep behavior
identical while reopening the hole:
- validateAuth: a static tripwire asserting crypto.timingSafeEqual + the
  got.length===want.length gate + the null-header guard (a revert to `===`
  keeps accept/reject green but restores the timing side-channel).
- redact: a table-driven loop over the exported URL_PASSWORD_PLACEHOLDER_WORDS
  so a typo or dropped entry can't silently start blocking a doc placeholder;
  plus a substring-can't-rescue-a-real-secret assertion.
- config: assert the self-contained .gitignore is written even when git already
  ignores .gstack/, proving the write precedes the isIgnoredByGit early return.
- bun-polyfill: cover the 128+signal exit branch (POSIX only).

URL_PASSWORD_PLACEHOLDER_WORDS is exported so the table test can't drift.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

browse/test/bun-polyfill.test.ts

@@ -123,6 +123,22 @@ describe('bun-polyfill', () => {
     expect(out).toMatch(/^exit:\d+$/);
   });
 
+  // Signal-exit branch: Bun reports 128 + signal number when a child is killed
+  // by a signal (code === null). Skipped on Windows, whose kill() semantics
+  // don't produce the POSIX 128+n mapping.
+  test.skipIf(process.platform === 'win32')('Bun.spawn proc.exited maps a killing signal to 128+signal', async () => {
+    const result = Bun.spawnSync(['node', '-e', `
+      require(${JSON.stringify(polyfillPath)});
+      (async () => {
+        const p = Bun.spawn(['node', '-e', 'setInterval(() => {}, 1000)'], { stdio: ['ignore', 'ignore', 'ignore'] });
+        setTimeout(() => p.kill('SIGTERM'), 150);
+        console.log('exit:' + await p.exited);
+      })();
+    `], { stdout: 'pipe', stderr: 'pipe' });
+    // SIGTERM = 15 → 128 + 15 = 143.
+    expect(result.stdout.toString().trim()).toBe('exit:143');
+  });
+
   // GSTACK_SPAWN_MAX_BUFFER caps the drain so a runaway child can't OOM the
   // server. Past the cap, the pipe keeps flowing (child doesn't block) but
   // further bytes are dropped. Set a small cap, write more than that, assert