fix(normalize): strip placeholder-escape PUA sentinels before detection

[lBroth]

Summary

• GLiNER was tagging the bare PUA pair (U+E000 U+E001) used to escape user-authored {{ as private_person. Vault substitution then replaced the leading sentinel with {{PII_PRIVATE_PERSON_*}}, corrupting templates like {{short-kebab-case-slug}} into {{PII_..._}}short-kebab-case-slug}}.
• Root cause: any-ascii returns "" for PUA chars; transcodeChar falls through to preserve them verbatim, so the tokenizer sees them as UNK tokens that the model labels as a person.
• Fix: add the sentinels to ZERO_WIDTH_CHARS so normalizeForDetection strips them before detection. Model never sees the sentinels; offset remap covers the original positions, so vault substitution skips them.

Test plan

• npm test — 271 passing (new: PUA strip + remap in normalize.test.ts, round-trip integration on {{template}} + email in nullpii.test.ts)
• npm run typecheck — clean
• npm run lint — clean
• npm run build — clean
• Repro on gateway with real Anthropic Messages API call carrying {{short-kebab-case-slug}} in system prompt — verify template survives sanitize round-trip

Out of scope

• Model still false-positives on template content itself (e.g. short-kebab-case-slug tagged as person → produces {{{{PII_..._}}}} nested-braces syntax). Separate harder problem — needs template-aware skip ranges or grammar-aware detector pass.

🤖 Generated with Claude Code