fix(redact): large reports survive the pipe — exitCode instead of process.exit; inert test payload

The wave's PR quality gate failed closed: gate-secret-scan.mjs pipes the
diff's added lines into gstack-redact and parses the JSON report, but
process.exit() discards stdout still buffered in the pipe — this wave's
646-finding report (202 KB) is the first big enough to arrive truncated
(~145 KB) at node's collector, so JSON.parse failed and the gate read
'no report' as HIGH. The report and auto-redact body paths now set
process.exitCode and let the runtime drain stdout; exit-code contract
unchanged (verified 0/2/3 end-to-end). Also: the C1 test's stdin payload no
longer uses a provider-prefix credential shape (the gate correctly flagged
it; the content was never read on the error path under test).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/gstack-redact

@@ -307,7 +307,9 @@ function main() {
           "\n",
       );
     }
-    process.exit(0);
+    // Same truncation class as the report path below: the redacted BODY can
+    // be arbitrarily large; let stdout drain instead of process.exit(0).
+    return;
   }
 
   const result = scan(input, opts);
@@ -326,7 +328,12 @@ function main() {
       process.stdout.write(`  HIGH=${HIGH} MEDIUM=${MEDIUM} LOW=${LOW} WARN=${WARN}\n`);
     }
   }
-  process.exit(code);
+  // process.exit() discards stdout still buffered in the pipe: a report past
+  // ~145 KB read by a slow consumer (node's gate-secret-scan.mjs collector)
+  // arrived truncated, JSON.parse failed, and the CI quality gate failed
+  // CLOSED on a clean scan. Set the exit code and let the runtime drain
+  // stdout instead — same contract, no truncation.
+  process.exitCode = code;
 }
 
 main();