fix: pre-landing review fixes

Review army findings (1 critical, auto-fixed with regression tests):

- CRITICAL (security specialist, verified live): redactFindingSpans spliced
  only the regex capture span, and pem.private_key / gcp.service_account
  capture just the BEGIN-header — the key body survived "redaction" and
  shipped via telemetry. Marker-only patterns now drop the whole payload
  (null, fail closed). Overlapping spans (Bearer+JWT on the same bytes) are
  coalesced before splicing so stale offsets can't leave partial secret
  bytes behind.
- gitStrict: drop the dead `|| r.status === null` disjunct (null !== 0
  already covers it); add the signal-kill/null-status regression test the
  docstring promised.
- security-dashboard human mode flags stale snapshots ("figures may be out
  of date") instead of presenting frozen counts as current.
- community-dashboard marker check uses jq when available — the grep-only
  variant misclassified whitespaced/reserialized bodies as legacy.
- telemetry fail-closed test now shadows bun with a failing stub
  (deterministic on any host layout); stale "five status cases" describe
  title renamed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/security-dashboard-fallback.test.ts

@@ -182,6 +182,13 @@ describe("gstack-security-dashboard — never reports fake zeros (#1947)", () =>
     expect(parsed.stale).toBe(true);
   });
 
+  it("stale snapshot is flagged in human mode too — frozen figures never read as current", () => {
+    const staleBody = JSON.stringify({ ...JSON.parse(GOOD_BODY_MARKER), stale: true });
+    const r = run(SEC_BIN, { mode: "ok", body: staleBody });
+    expect(r.stdout).toContain("Attacks detected last 7 days: 3");
+    expect(r.stdout).toContain("stale snapshot");
+  });
+
   it("200 without marker (legacy backend) → figures shown with unverified note", () => {
     const r = run(SEC_BIN, { mode: "ok", body: GOOD_BODY_LEGACY });
     expect(r.stdout).toContain("Attacks detected last 7 days: 3");
@@ -238,4 +245,13 @@ describe("gstack-community-dashboard — never reports fake zeros (#1947)", () =
     expect(r.stdout).toContain("unknown — backend error (HTTP 200)");
     expect(r.stdout).not.toContain("Weekly active installs:");
   });
+
+  it("whitespaced marker ('\"status\": \"ok\"') still classified as verified when jq is present", () => {
+    // Pre-landing review: the grep-only marker check was whitespace-sensitive;
+    // a proxy-reserialized body must not be misclassified as legacy.
+    const spaced = GOOD_BODY_MARKER.replace('"status":"ok"', '"status": "ok"');
+    const r = run(COMM_BIN, { mode: "ok", body: spaced });
+    expect(r.stdout).toContain("Weekly active installs: 42");
+    expect(r.stdout).not.toContain("unverified");
+  });
 });