fix(cso): helper JSON keeps run URLs only in the validated workflow slot

The shared redactor now treats GitHub Actions run ids as CI metadata
(c245d1bc2), so main's #3041 invariant that the same run digits stay
redacted outside qualification.workflow held only through the phone
false positive. Make it explicit in the CSO sanitizer.

lib/cso/process.ts

@@ -225,10 +225,13 @@ function safeMetadata(value: string, key: string): boolean {
     return true;
   return false;
 }
+// Run ids are public CI metadata to the shared redactor; here only the validated
+// workflow slot may carry one.
+const RUN_ID_SEGMENT = /(\/actions\/runs\/)[0-9]+/g;
 function sanitizeJson(value: unknown, key: string, seen: WeakSet<object>, trustedMetadata: boolean): unknown {
   if (typeof value === 'string') {
     if (trustedMetadata && safeMetadata(value, key)) return value;
-    return redact(value);
+    return redact(value).replace(RUN_ID_SEGMENT, '$1<REDACTED-ci-run-id>');
   }
   if (value === null || typeof value !== 'object') return value;
   if (seen.has(value as object)) throw new CsoError('INVALID_SCHEMA', 'Cyclic JSON cannot be persisted');