evidence(OMN-17188): OCC evidence for OmniNode-ai/omnidash#305

[jonahgabriel]

Appends a dod_evidence entry + PASS receipt binding OMN-17188 to OmniNode-ai/omnidash#305.

#305 is the second attempt at CodeQL alerts #14/#15, diagnosed from the analysis SARIF rather than guessed. The data-flow path ran straight THROUGH both replace calls, so CodeQL treated neither as a sanitizer. The query source is decisive: StringReplaceSanitizer requires replaces(s, "") and s.regexpMatch("\\n"), and replaces(old,new) resolves new via getRawReplacement().mayHaveStringValue — so a ' ' replacement yields new = " " and never matches. #304's character-class-vs-alternation theory was wrong; the replacement string was the defect.

Append-only: the #302 and #304 entries and receipts are untouched.

Evidence-Source: OCC#7788
Evidence-Ticket: OMN-17188

[coderabbitai]

Warning

Review limit reached

Next included review available in 41 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 138 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2c2e536d-e406-414e-a59b-abb307a8eada

📥 Commits

Reviewing files that changed from the base of the PR and between 420f940 and c999750.

📒 Files selected for processing (2)

• contracts/OMN-17188.yaml
• drift/dod_receipts/OMN-17188/dod-OmniNode-ai-omnidash-pr-305/command.yaml

---

_{Comment @coderabbitai help to get the list of available commands.}