fix(ai): harden public rewrite sanitizer

[JSONbored]

Motivation

• Close a sanitizer bypass where the optional AI public-rewrite path could publish forbidden public terms (e.g. bare "scoreability", "reviewability", trust-score and credential variants, and ranking/reward language) because it relied on a weaker word list/regex than the canonical GitHub public-comment sanitizer.

Description

• Expanded the canonical forbidden-word list in src/queue-intelligence.ts to include trust/credential variants, reviewability/scoreability terms, score previews/estimates, and related phrases so the centralized sanitizer covers those additional unsafe terms.
• Hardened the AI-side defenses in src/services/ai-summaries.ts by adding the missing terms to PUBLIC_FORBIDDEN_TEXT_PATTERN and PRIVATE_CONTEXT_PATTERN, and tightened the system/instruction prompts used when calling Workers AI so scoreability/reviewability are explicitly disallowed in public outputs.
• Preserved the deterministic fallback behavior for every non-ok AI outcome so public posting always uses the deterministic template when AI is disabled, unavailable, over quota, unsafe, or errors.
• Added/updated unit tests in test/unit/ai-summaries.test.ts to cover scoreability, reviewability, reviewability internals, and the reported rewards/scoreability bypass case.

Testing

• Ran targeted unit tests: npm test -- --run test/unit/ai-summaries.test.ts — all tests passed (43 passed).
• Type checking: npm run typecheck (tsc --noEmit) completed with no errors.
• Ensured repository hygiene with git diff --check (no problems reported).

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#491 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	7ba633c	Commit Preview URL Branch Preview URL	Jun 10 2026, 06:32 AM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.