🛡️ Sentinel: [CRITICAL] Fix hardcoded token leak on command failure

[seonghobae]

🚨 Severity: CRITICAL
💡 Vulnerability: scripts/ci/pr_review_autofix_context.py 파일의 run_json 함수가 서브프로세스 명령어(gh) 실패 시 반환되는 stderr를 마스킹 없이 그대로 RuntimeError로 발생시킴.
🎯 Impact: GitHub Actions CI 과정 중 명령어 실패로 인해 토큰(GH_TOKEN 등)이나 시크릿 값이 로그나 에러 트레이스백에 노출될 위험이 있음.
🔧 Fix:

• scripts/ci/pr_review_autofix_context.py에 사전에 컴파일된 시크릿 패턴(SENSITIVE_DATA_SCRUB_PATTERNS)과 scrub_sensitive_data 유틸리티 추가.
• run_json 오류 발생 시 stderr를 scrub_sensitive_data를 통해 마스킹 후 예외를 발생시키도록 변경.
• 부가적으로 noema_review_gate.py 내의 SSRF URL 검사에서 http://와 https://의 대소문자를 구분하지 않도록 수정(관련 테스트 코드 대응 완료).
  ✅ Verification: python3 -m pytest tests/ 테스트 커버리지 100% 통과 및 bandit -r scripts/ 검증 성공.

---

PR created automatically by Jules for task 4726700375958637105 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.