fix: telemetry path leak + REPL hardcoded block count

[b-macker]

Summary

Fixes from Gemini 30-level slop audit triage. Of ~20 findings, 15 were false positives or by-design. 2 real issues fixed here:

• G-1 (CRITICAL): Telemetry events in governance_reports.cpp included raw absolute paths (ev["file"] = current_check_file_) forwarded unsanitized to external webhooks via telemetry_forwarder.cpp. Applied ErrorSanitizer::sanitizeFilePaths() at both emission sites (refusal attestation + check results loop).
• G-2 (LOW): REPL printed hardcoded "24,167 blocks available" — a static number with no runtime basis. Removed.

Notable false positives from the audit

• L9 "STANDARD sandbox too permissive" — BY DESIGN (enforce upgrades unrestricted→standard)
• L15 "Persistent executor loses state" — FALSE (name means subprocess lifetime, not session state)
• L27 "No retry in agent_provider" — FALSE (retry+backoff+jitter exists in agent_impl.cpp)
• L1 "51 STUBs" — OVERSTATED 8.5x (only 5 remain, already cleaned in R8)
• L17 "Redundant sort" — FALSE (SQL sorts by usage, C++ re-sorts by computed weighted score)

Test plan

• Build: 0 errors
• Security leak test: 738/738, 0 failures
• Config fuzz test: 100/100, 0 crashes
• Full test suite: 396/396 accounted, 0 unexpected failures

🤖 Generated with Claude Code

[github-actions]

NAAb Governance Report

Metric	Count
Files checked	16
Passed	16
Failed	0

All governance checks passed!

_{Generated by NAAb Governance Engine v4.0}