Remediate Reachable DLP sinks and harden CI file/path handling

[Copilot]

This PR addresses the selected Reachable shard: raw PII exposure from SupportExport, DB-derived content flowing into emitted summary output, and symlink-unsafe file access in the targeted CI scripts.

• Redact DLP sinks in internal/handlers/dlp.go

  • Remove raw SSN/DOB from log output.
  • Replace the outbound analytics payload with a non-PII event shape.
  • Preserve the existing CSV response contract.

• Bound DB-derived output in ci/reachable-cache-evidence.py

  • Sanitize and length-bound scan fields loaded from repo.db before including them in the emitted evidence payload.
  • Keep numeric fields intact while preventing raw multiline/unbounded content from propagating into downstream consumers.

• Harden selected CI file operations against symlink escape

  • Add a small shared resolve_within helper for path containment.
  • Apply it to the selected sinks in:
    • ci/smoke-pages-summary.py
    • ci/validate-marketplace-metadata.py
    • ci/smoke-db-remediation-proof.py
  • Reject paths that escape the intended root, resolve through broken symlinks, or rely on missing parent directories.

• Add focused regression coverage

  • Add Go tests for redacted SupportExport logging/outbound behavior while preserving legitimate CSV output.
  • Add smoke coverage for:
    • sanitized cache-evidence DB summaries
    • symlink escape rejection
    • missing-parent path rejection
    • marketplace metadata validation through safe path resolution

Example of the DLP change:

log.Printf("Processing support export fixture pii_redacted=true records=1")
payload, _ := json.Marshal(map[string]any{
    "event":                  "support_export_generated",
    "contains_synthetic_pii": true,
    "records":                1,
})