fix: extend security sanitization + add 10 tests for merged community PRs

- Extend json_safe() to ERROR_CLASS and FAILED_STEP fields
- Improve ERROR_MESSAGE escaping to handle backslashes and newlines
- Replace python3 with bun for JSON validation in gstack-review-log
- Add 7 telemetry injection prevention tests
- Add 2 review-log JSON validation tests
- Add 1 discover-skills hidden directory filtering test

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bin/gstack-review-log

@@ -9,7 +9,7 @@ mkdir -p "$GSTACK_HOME/projects/$SLUG"
 
 # Validate: input must be parseable JSON (reject malformed or injection attempts)
 INPUT="$1"
-if ! printf '%s' "$INPUT" | python3 -c "import json,sys; json.load(sys.stdin)" 2>/dev/null; then
+if ! printf '%s' "$INPUT" | bun -e "JSON.parse(await Bun.stdin.text())" 2>/dev/null; then
   # Not valid JSON — refuse to append
   echo "gstack-review-log: invalid JSON, skipping" >&2
   exit 1