test: coverage-audit additions for the fix wave

Ship Step 7 gap-fill (all passing, 248 tests across the touched suites):
memory + dream stage probe-timeout proceeds, gbrain-detect override paths,
stale-flag passthrough, 200-body-missing-.security fail-closed case,
telemetry redaction edges, and credential-pattern edge cases.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/redact-engine.test.ts

@@ -12,6 +12,7 @@ import {
   exitCodeFor,
   maskPreview,
   normalizeWithMap,
+  redactFindingSpans,
   type RepoVisibility,
 } from "../lib/redact-engine";
 import {
@@ -364,6 +365,52 @@ describe("masking + purity", () => {
   });
 });
 
+describe("redactFindingSpans — machine-egress masking (#1947)", () => {
+  test("clean input passes through unchanged", () => {
+    const text = "push failed: remote rejected the branch";
+    expect(redactFindingSpans(text, { repoVisibility: "private" })).toBe(text);
+  });
+
+  test("a single finding's span becomes <REDACTED-{id}>, context survives", () => {
+    const token = "ghp_" + "1234567890abcdefghijklmnopqrstuvwxyz";
+    const out = redactFindingSpans(`auth ${token} rejected`, { repoVisibility: "private" });
+    expect(out).toBe("auth <REDACTED-github.pat> rejected");
+  });
+
+  test("multiple findings are all replaced (right-to-left splice keeps offsets valid)", () => {
+    const pat = "ghp_" + "1234567890abcdefghijklmnopqrstuvwxyz";
+    const aws = "AKIA1234567890ABCDEF";
+    const out = redactFindingSpans(`first ${aws} then ${pat} end`, {
+      repoVisibility: "private",
+    });
+    expect(out).toBe("first <REDACTED-aws.access_key> then <REDACTED-github.pat> end");
+  });
+
+  test("fails closed (null) when a span cannot be relocated — never raw passthrough", () => {
+    // env.kv's span (the value) starts well past the regex match start (the
+    // var name), so locateSpan's rewind-2 re-exec misses it. The contract is
+    // null → caller drops the whole payload. The one thing that must never
+    // happen is the secret surviving in the output.
+    const secret = "8Fk2pQ9vXz4wL7mN3rT6yB1cD5eG0hJq";
+    const out = redactFindingSpans(`API_KEY=${secret}`, { repoVisibility: "private" });
+    if (out !== null) {
+      // If locateSpan ever learns to find context-prefixed spans, masking
+      // must actually mask.
+      expect(out).not.toContain(secret);
+    } else {
+      expect(out).toBeNull();
+    }
+  });
+
+  test("multiline input redacts a finding past the first line (locateSpan line/col path)", () => {
+    const token = "ghp_" + "1234567890abcdefghijklmnopqrstuvwxyz";
+    const out = redactFindingSpans(`line one\nline two has ${token}\nline three`, {
+      repoVisibility: "private",
+    });
+    expect(out).toBe("line one\nline two has <REDACTED-github.pat>\nline three");
+  });
+});
+
 describe("taxonomy integrity", () => {
   test("every pattern has a unique id", () => {
     const set = new Set(PATTERNS.map((p) => p.id));