fix(review): preserve safe enrichment lines when sanitizer finds forbidden terms

[JSONbored]

Motivation

• A single non-public-safe line in a REES brief could cause sanitizePublicComment to throw and the engine to drop the entire enrichment prompt, allowing a malicious commit subject to suppress unrelated security findings.
• The goal is to make sanitization fail-safe at line granularity so unsafe lines are removed while preserving the rest of the brief.

Description

• Update sanitizeEnrichmentPromptSection in src/review/enrichment-wire.ts to first attempt sanitizing the whole defanged brief and, if that throws, fall back to per-line sanitization that keeps only lines which individually pass sanitizePublicComment and then truncates to MAX_ENRICHMENT_PROMPT_SECTION_CHARS.
• Preserve existing neutralizePromptInjection defanging step and ensure the function returns undefined when no safe lines remain.
• Add a regression unit test in test/unit/enrichment-wire.test.ts that simulates a brief containing an unsafe commit-lint line plus an independent dependency advisory and asserts the advisory is preserved while the unsafe line is dropped.

Testing

• Ran npx vitest run test/unit/enrichment-wire.test.ts, and the new test (and the file's suite) passed.
• Ran npm run typecheck, which completed with no type errors.
• Ran git diff --check, which reported no whitespace/conflict issues.
• Attempted npm run test:coverage (full coverage gate) in this environment but the global coverage threshold run did not succeed (the repository-wide coverage thresholds were not met when running the local coverage job here).
• Attempted npm audit --audit-level=moderate but the npm registry audit endpoint returned 403 Forbidden in this environment, so the dependency-review step could not be completed here.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.38%. Comparing base (bddbfa0) to head (9d42491).
⚠️ Report is 20 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3753   +/-   ##
=======================================
  Coverage   93.37%   93.38%           
=======================================
  Files         316      316           
  Lines       32296    32303    +7     
  Branches    11841    11842    +1     
=======================================
+ Hits        30158    30165    +7     
  Misses       1507     1507           
  Partials      631      631           

Files with missing lines	Coverage Δ
src/review/enrichment-wire.ts	99.31% <100.00%> (+0.03%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.