fix(redact): large reports survive the pipe — exitCode instead of process.exit; inert test payload

The wave's PR quality gate failed closed: gate-secret-scan.mjs pipes the
diff's added lines into gstack-redact and parses the JSON report, but
process.exit() discards stdout still buffered in the pipe — this wave's
646-finding report (202 KB) is the first big enough to arrive truncated
(~145 KB) at node's collector, so JSON.parse failed and the gate read
'no report' as HIGH. The report and auto-redact body paths now set
process.exitCode and let the runtime drain stdout; exit-code contract
unchanged (verified 0/2/3 end-to-end). Also: the C1 test's stdin payload no
longer uses a provider-prefix credential shape (the gate correctly flagged
it; the content was never read on the error path under test).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/regression-pr1169-mktemp-fallbacks.test.ts

@@ -120,7 +120,7 @@ echo "SHOULD NOT REACH: $TMP_DIR"`;
     const r = spawnSync(
       "bun",
       [path.join(ROOT, "bin", "gstack-redact"), "--from-file", "", "--json"],
-      { encoding: "utf-8", input: "sk-ant-api03-not-really-a-key", timeout: 15_000 },
+      { encoding: "utf-8", input: "placeholder stdin content (never read on the error path)", timeout: 15_000 },
     );
     expect(r.status).toBe(1);
     expect(r.stderr).toContain("non-empty path");