fix(security): redact fine-grained PATs from workflow registry diagnostics

[seonghobae]

Scope

Harden the Noema-owned workflow-registry audit so failed collection and live GitHub CLI diagnostics cannot disclose fine-grained GitHub personal access tokens.

RED regression

Commit 5519e76179b17e599f07c800b6bb0b3dc4c16a1e adds an executable regression through collectLiveWorkflowRegistryAudit(): a simulated registry failure contains a github_pat_... token and the returned failure detail must redact it. Protected main redacted bearer/classic gh* tokens but not fine-grained PATs.

The first pull-request CI run (32042751541) was stopped earlier by the repository's live-base verification step before release verify, so that run is infrastructure/control evidence rather than a semantic test result. The defect itself is directly established by the protected-main sanitizer source and the regression contract; no skipped test is counted as passing evidence.

Repair

• fb018c4231b1c6d3094ef72936e7f1e076a298ba adds github_pat_... redaction to the bounded registry collection failure sanitizer.
• 6344c4d5f4480b98d40a553957554e7e4b7e6522 applies the same redaction at the live gh subprocess diagnostic boundary so raw fine-grained PATs are removed before an error is propagated.
• Existing bearer, token-assignment, URL/query-token, classic gh*, bounded-length, UTF-8 and fail-closed behavior is retained.

Verification boundary

This PR remains Draft until exact-current-head application CI, reviewer-ci and central Security Scan complete successfully. Predecessor runs and skipped steps do not count.

Ownership

No foreign dedicated-writer repository source/docs/refs are modified. This PR changes only ContextualWisdomLab/noema.

Related: #226

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}