fix(engine): gate-advisory.ts's CHECK_RUN_FORBIDDEN_TERMS has silently drifted from its host twin, missing two redaction terms

[JSONbored]

⚠️ Definition of Done: this issue must be completed in full, in a single PR. Do not split this
work across multiple PRs, and do not defer any Deliverable below to a follow-up issue. A PR that
satisfies only some of the Deliverables, stubs a required test, or leaves a checkbox
partially-done does NOT resolve this issue and will be closed.

Context

packages/loopover-engine/src/advisory/gate-advisory.ts:33-34 and src/rules/advisory.ts:381-382
both carry the identical comment claiming they are "Kept byte-identical with the
GATE_DECISION_TWIN_PAIR copy ... (checkGateDecisionVersionBump enforces this)". The regex bodies
are not actually identical: the host copy (src/rules/advisory.ts:382) has two extra alternatives
appended — |likely_duplicate|reviewability\s*\d — that the engine copy
(gate-advisory.ts:33-34) lacks.

checkGateDecisionVersionBump (scripts/check-engine-parity.ts:374-405) only checks that a PR
touching one twin file also bumps the engine package version or touches the other file — it never
diffs their actual content. GATE_DECISION_CORE_MARKERS (lines 35-40) only checks that 4
function-name markers are present in both, not that the regex body matches. So the "byte-identical,
enforced" claim in both files' own comments is false, and no CI mechanism currently catches this
class of drift.

sanitizeForCheckRun (built from this regex, gate-advisory.ts:535,551,557) redacts finding
titles/actions before rendering into check-run text. Today this isn't an active leak because the
only in-repo consumer of the engine copy's evaluateGateCheck/buildPullRequestAdvisory happens
to also apply a second, independent, single-sourced sanitizer
(packages/loopover-engine/src/github/sanitize-public-comment.ts's sanitizePublicComment) that
does catch likely_duplicate/reviewability — but this is a silent defense-in-depth erosion
masquerading as an enforced invariant, and any future direct consumer of the engine package's
evaluateGateCheck output would leak these terms into a public check-run untouched.

Requirements

• Update packages/loopover-engine/src/advisory/gate-advisory.ts's CHECK_RUN_FORBIDDEN_TERMS regex
  to match src/rules/advisory.ts's current body exactly, including the likely_duplicate and
  reviewability\s*\d alternatives.
• Strengthen checkGateDecisionVersionBump (or add a new, separate check) to actually diff the
  regex body content between the two twin copies, not just check for marker presence, so a future
  divergence like this one is caught by CI immediately.

Deliverables

• gate-advisory.ts's CHECK_RUN_FORBIDDEN_TERMS matches src/rules/advisory.ts's body
  exactly.
• scripts/check-engine-parity.ts (or a new dedicated check) diffs the actual regex body of both
  twin copies, not just marker/function-name presence.
• A new test proves sanitizeForCheckRun in gate-advisory.ts now redacts a finding title/action
  containing "likely_duplicate" and "reviewability 87" — currently it does not.
• A new test proves the strengthened drift check fails when the two regex bodies are made to
  diverge again (a synthetic fixture), mirroring the existing marker-presence test pattern in
  test/unit/check-engine-parity-script.test.ts.

All four Deliverables are required in the same PR.

Test Coverage Requirements

packages/loopover-engine/** and scripts/** are both measured by codecov/patch (99%+ target,
branch-counted). New tests must exercise the previously-unredacted terms directly and the
strengthened drift-check's failure path.

Expected Outcome

Both copies of CHECK_RUN_FORBIDDEN_TERMS are genuinely byte-identical, and the CI drift check can
actually detect a future divergence in the regex body itself, not just the function names' presence.

Links & Resources

• packages/loopover-engine/src/advisory/gate-advisory.ts:33-34,535,551,557
• src/rules/advisory.ts:381-382 (the canonical, current body)
• scripts/check-engine-parity.ts:374-405 (checkGateDecisionVersionBump, GATE_DECISION_CORE_MARKERS)
• packages/loopover-engine/src/github/sanitize-public-comment.ts (the independent sanitizer that
  currently masks this from being an active leak)
• test/unit/check-engine-parity-script.test.ts (existing test pattern to mirror)

[linear-code]

JSO-6039