fix(signals): centralize public local-path redaction across drifted surfaces

[kiannidev]

Summary

src/signals/redaction.ts is the canonical public/private boundary (#542), and it already redacts /Users/, /home/, /root/, and /tmp/ (plus Windows …\Users\…). Several other public surfaces still carry their own copy of the local-path denylist and have drifted — most miss /root/, and most miss /var/ (which miner-dashboard-recommendations.ts already treats as local).

A contributor or operator running from /root/... or /var/... paths can leak absolute local paths through these surfaces even though the canonical boundary blocks them.

Drifted surfaces (this issue's scope)

Module	Current denylist gap
focus-manifest.ts isFocusManifestPublicSafe	missing /root/, /var/
control-panel-roles.ts sanitizeRoleText	missing /root/, /var/
weekly-value-report.ts sanitizeReportText	missing /root/, /var/
db/repositories.ts product-usage metadata scrubber	missing /root/, /var/
agent-action-explanation-card.ts token/path scrubber	missing /root/, /var/
local-branch.ts safeRepoPath	missing /var/
miner-dashboard-recommendations.ts	has /var/ but uses a one-off regex

Proposed fix

1. Export shared local-path constants/helpers from src/signals/redaction.ts (PUBLIC_LOCAL_PATH_INLINE, prefix/scrub patterns, and small helpers).
2. Compose PUBLIC_UNSAFE_PATTERN from the shared export so the canonical boundary cannot drift again.
3. Wire every drifted surface above to the shared helpers instead of re-typing path fragments.
4. Add /var/ consistently (matching the established intent in miner-dashboard-recommendations.ts).
5. Add/extend unit tests for each wired surface.

Out of scope

• pr-body-draft.ts keeps its richer generic local-path matcher (by design — it scrubs arbitrary /segment/... paths, not just known roots).
• Context-specific phrase vocabularies in agent-action-explanation-card.ts and miner-dashboard-recommendations.ts stay local (per refactor(signals): shared public-safe redaction module #542).