fix: pre-landing review fixes

Review army findings (1 critical, auto-fixed with regression tests):

- CRITICAL (security specialist, verified live): redactFindingSpans spliced
  only the regex capture span, and pem.private_key / gcp.service_account
  capture just the BEGIN-header — the key body survived "redaction" and
  shipped via telemetry. Marker-only patterns now drop the whole payload
  (null, fail closed). Overlapping spans (Bearer+JWT on the same bytes) are
  coalesced before splicing so stale offsets can't leave partial secret
  bytes behind.
- gitStrict: drop the dead `|| r.status === null` disjunct (null !== 0
  already covers it); add the signal-kill/null-status regression test the
  docstring promised.
- security-dashboard human mode flags stale snapshots ("figures may be out
  of date") instead of presenting frozen counts as current.
- community-dashboard marker check uses jq when available — the grep-only
  variant misclassified whitespaced/reserialized bodies as legacy.
- telemetry fail-closed test now shadows bun with a failing stub
  (deterministic on any host layout); stale "five status cases" describe
  title renamed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/redact-prepush-hook.test.ts

@@ -127,6 +127,31 @@ describe("fail closed on unscannable diffs (#1946)", () => {
     const { code } = runHook(`refs/heads/main ${head} refs/heads/main ${head}\n`);
     expect(code).toBe(0);
   });
+
+  test("a diff killed by a signal (null status — the maxBuffer/kill class) BLOCKS", () => {
+    // Stub git: probes delegate to the real git; the diff invocation kills
+    // itself, producing spawnSync status === null. This is the exact branch
+    // gitStrict's docstring names (oversized-diff overflow is delivered the
+    // same way) — pre-landing review flagged it as untested.
+    const realGit = Bun.which("git") || "/usr/bin/git";
+    const stubDir = fs.mkdtempSync(path.join(os.tmpdir(), "prepush-stubgit-"));
+    try {
+      const stub = `#!/bin/sh\nif [ "$1" = "diff" ]; then kill -KILL $$; fi\nexec "${realGit}" "$@"\n`;
+      fs.writeFileSync(path.join(stubDir, "git"), stub);
+      fs.chmodSync(path.join(stubDir, "git"), 0o755);
+
+      const base = git(["rev-parse", "HEAD"]);
+      const head = commit("clean.txt", "clean content\n", "clean commit");
+      const { code, stderr } = runHook(`refs/heads/main ${head} refs/heads/main ${base}\n`, {
+        PATH: `${stubDir}:${process.env.PATH}`,
+      });
+      expect(code).toBe(1);
+      expect(stderr).toContain("could not compute the pushed diff");
+      expect(stderr).toContain("GSTACK_REDACT_PREPUSH=skip");
+    } finally {
+      fs.rmSync(stubDir, { recursive: true, force: true });
+    }
+  });
 });
 
 describe("install UX surfaces (#1946 / eng review D3+D10)", () => {